Why can a MCU input floating pin easily change state?
As an ultra simplified, 1st year EE model, you can consider a disconnected input to a CMOS chip to be an RC circuit.

The tiny gate leakage currents represent the R, and the tiny gate capacitances plus the stray capacitance from the pad or pin to the outside world being the C's.  Change the external EM field to the outer plate of the capacitor enough (ground noise, other nearby PCB traces switching, bonding pad cross-talk, cosmic rays, etc.) and you can change the voltage on the transistor gate.