Why is the vector sampled from Gaussian or Subgaussian distribution in lattice-based cryptography?
You can't directly sample uniformly modulo a lattice unless you know what the lattice is. The Gaussian distribution can be sampled independently of knowledge of the lattice. This distinction is important in situations where the lattice is part of a cryptographic secret.