If user forgets password or if accounts is locked, some way is needed for user to reset the password. It can be done by asking some questions about something that is expected not to be known to any random person, or by sending an SMS, or by sending a temporary password or some link to user per email. If user has not confirmed the access to the provided email, resetting the password via email may be impossible.
Asking questions (like the title of your favorite movie) is usually not very reliable, because such information can be known to many persons. It can only be reliable, if the user provides as an answer some relatively long random string, generated by a good random generator. Since the most users are expected to provide the real answers, this can be insecure.
Emails are considered as more secure, because it is expected that only the user has access to the email box.
In case the email is validated after registration many web sites don't usually enable any services until the email is validated. Thus user is forced to validate the email.
From the security point of view validating the email in advance or afterwards has no difference.
Validation at different phase can have usability differences. E.g. some users may prefer providing email and password at the beginning and validate the email later on, because they may find association between email and password more natural, because it happens at the same time. Whereas providing first the email, then validating, then providing the password may break such association. But as many usability aspects this is a matter of taste.
There are also other aspects not related to security. Validating email in advance makes sure that the user is the owner of the email. Whereas validating it after registration may enable the kind of defamation. E.g. you may register your neighbor at some web site associated with drugs or alcohol and never confirm it later, because you don't own this email. But if the web site keeps such unconfirmed accounts, and if the list of the users becomes widely known, this might have some reputation effect for the person whose email was used for registration. But again, this is not a security aspect.