The code is generated by the current registrar and stored at the registry. To move a domain you obtain it from the current registrar, give it to the new registrar, and the new registrar presents it to the registry with the transfer request. If it matches, the transfer is allowed to proceed.
For gTLDs, registrars must provide the code within five calendar days of the registrant asking for it and may not make it conditional on anything other than identity checks. Some ccTLDs use a different mechanism or name for the same idea.
Treat the code like a password: anyone who has it, and who finds the domain unlocked, can start a transfer. Keeping the registrar lock (clientTransferProhibited) switched on is the simple protection, since a locked domain cannot be transferred even with the correct code.