That setting is used to block (or permit) password auth to Yahoo's POP3/IMAP/SMTP servers. They want you to use OAuth tokens instead.
The advantage of OAuth is that the app itself doesn't actually store your password - in fact, needn't ever even see your password - and has only an app-specific access token and refresh token. The use of those tokens can be tracked individually, and revoked at need, without impacting other apps (unlike a password). The token also can't be used to sign into the web portal and do things like change settings, again, unlike a password.
Still, the way they will prompt you every single time you log in to "disable insecure access" is intensely irritating, especially because they don't know how the clients are storing those passwords (for example, if I don't have Outlook store the password and just enter it every time I sign in, then most of their concern is irrelevant) and also because training people to click through scary-looking warnings is a TERRIBLE thing to do.