Administrators sometimes set it to control when changes happen, because of staging rules, or because a host manages updates elsewhere. It can also be left behind from an old troubleshooting session.
The constant switches off automatic security updates as well as feature updates. If it is set and nobody is applying updates manually, a site can fall behind on known vulnerabilities without any visible warning.
Search wp-config.php for it during any patch review. If it is present, confirm that a deliberate update process replaces what it disabled, and document who is responsible for that process.