It’s basically just an address similar to how an IP address is just an address. The security comes from you recognizing a Device ID and accepting it on both machines; and that Device IDs cannot be spoofed–they are verified cryptographically when connecting to make sure that the device is what it says it is during announce.
I’m not sure how true this is either… Folder ID : what does it do?