In a nutshell
A system call is how a program asks the operating system to do something it isn't allowed to do itself, like read a file from disk. A special trap instruction flips the CPU from restricted user mode into privileged kernel mode, the right handler does the protected work, and then control returns to the program. That controlled doorway is exactly what stops ordinary code from touching hardware directly.