Connected application exists only to provide internal connection between the package and Salesforce Setup settings.
In classic it would work without connected app, but since Lightning, connection to Salesforce Metadata API and UI API needs to have authorized callout.
App is doing following through mentioned APIs:
Controlling our Picklist values (for few ClosePlan objects)
Getting information about Sales Processes (Opportunity Stage setup)
Retrieving some additional user settings, such as if they use Comfy/Compact page layouts.
In terms of security, there is not need to be worried.