Why are VPP tokens dependent on Apple ID password?

When the Apple ID password is changed for an account that is associated with the VPP (Volume Purchase Program), the token for VPP also changes, why is that? And what affect could that have on any VPP apps that were already installed via an MDM server that would now have a revoked (obsolete) VPP token?