Certain pages must be used shortly after login; if that's not the case, the user is asked to reauthenticate. (See $wgReauthenticateTime.) This is to prevent an attacker from stealing a session cookie and then e.g. changing the password.
SUL3 handles authentication as the combination of the user-visible authentication action on the central domain plus an invisible login on the local domain. The local login happens not only when the user successfully logged in or signed up on the central domain, but also when they were already logged in there. That means just visiting the local login page will count as an (automatically successful) local reauthentication while the user is centrally logged in. This lets an attacker trivially circumvent security checks.
