it confirms the person trying to log in has access to the email. for example the guy remembering your password from watching you enter it, can’t use it to log in later as he doesn’t get the code.

still, there are better ways.