Even without that setting, there are protections against unauthorized domain name transfers. Here are the six steps required to transfer a domain name to a new registrar:
- Purchase and request domain transfer at the new registrar
- Request authorization code at current registrar.
- Authorization code received from current registrar.
- Begin the transfer from the new registrar using the authorization code.
- Email Notification from current registrar.
- Domain Transfer completed to new registrar
As you can see, there are several checks in place to ensure that domain names don't get stolen.
Client transfer prohibited is an extra precaution on top of all of this. When it is set, your current registrar doesn't have to respond requests from other registrars to transfer the domain name; even when there is a valid authorization code. Your current registrar won't send you email about transferring your domain that contain links that you might click accidentally. The setting protects against some forms of hacking and phishing that have been used to steal domain names.