the client has to authenticate with a central server and present a ticket to the server it wants to connect to. otherwise clients could impersonate each other easily.
sure, iirc it used to even just be a setting? online-mode=false
most servers leave it enabled because preventing player impersonation is pretty important so people can't just easily grief each other. some piracy servers implemented their own auth on top.