I am reading about Schnorr signature (for example, from BIP-340) and I thought, what if we add instead of multiplying for $$s$$? So, in the signing process it will be s = r + e + d mod n instead of s = r + e*d mod n. Verification will be the similar: calculate $$s*G$$ and compare it to $$r*G + e*G + P$$ instead of $$r*G + e*P$$.

$$(r*G,s)$$ is signature, $$d$$ is private key, $$P$$ is public key, $$r$$ is random value, $$e = hash(r*G, P, message)$$

Probably I am missing something obvious but I still did not get why it will be less secure. Signer shows that he knows the discrete logarithm of something for which he needs to know the private key.

With your modified signature scheme, you can generate forgeries with a single valid signature.

Let us assume you have a valid signature $$(rG, s)$$ to a message with hash $$e$$. That is, you have $$sG = rG + eG + P$$.

Then, if you have another message with hash $$e'$$ (with the same $$r$$), you can compute $$s' = s - e + e'$$; the new signature is $$(rG, s')$$

This validates, as $$s'G = (s - e + e')G = sG - eG + e'G = (rG + eG + P) - eG + e'G = rG + e'G + P$$