With RSA (or any asymmetric cryptography, for that matter), the key question is "how do you know you can trust the other peer's public key?". Without authentication, you could be sending your message using the attacker's public key.
Example 1: the first time you SSH to a host, you are prompted to confirm that you trust the public key. That's because if an attacker can intercept the communication and use their own unverified/unauthenticated key, they can decrypt your session by using man-in-the-middle attack.
Example 2: if the organization you work for uses a deep packet inspection firewall, and they enable SSL inspection, they will be instructing your workstation to trust their corporate public key. (which comes in the form of a certificate) Whenever you hit a site using HTTPS, their firewall will execute a man-in-the-middle attack, and you will [essentially] use the public key (found in the certificate, which you now trust) to secure the communications with your remote host. The contents of your session are now available to the organization.