the client has to authenticate with a central server and present a ticket to the server it wants to connect to. otherwise clients could impersonate each other easily.

There are server mods that remove this requirement though.

sure, iirc it used to even just be a setting? online-mode=false

most servers leave it enabled because preventing player impersonation is pretty important so people can't just easily grief each other. some piracy servers implemented their own auth on top.

If the server is configured to not require server auth.