What does reset password token protect against?

Question

This is more of a concept question than a specific code one. I am building a web app in Django which almost entirely handles the password reset process. And it had me thinking what does the token do, I'm aware that it checks whether the same email that requested the reset is the one changing the password. But why is this needed If someone tried to send a reset email to someone elses email they would need that emails password to actually change it. Is the token just another layer of protection? Is it necessary?

I also do not understand the way django handles it:

path('password-reset-confirm/<uidb64>/<token>/',
         auth_views.PasswordResetConfirmView.as_view(
             template_name='users/password_reset_confirm.html'
         ),

How does passing the token in here, which is the page you access when the reset email is sent to YOU, make it secure. The latter question isnt as important.