There's a quote in the comments on this post that puts it nicely:
Drupal maintains a table of who can access what; this needs to be rebuilt when a new module affecting user access is enabled.
Think of it as a cache-clear for node access data, except that it's quite complicated so needs to be run as a batch job rather than all at once (e.g. on a cron run).
Since node access is a sensitive issue it's also not wise to rely on scheduled jobs to make the necessary changes, hence why this is all done in one go.