Someone can please explain to me how does the "Same Origin Policy" feature protect us from web attacks (XSS,CSRF, etc)?
This depends on the context.
If you have a "Same Origin" policy on executing scripts within a website then only scripts which come from the same domain name (website) as the website itself can be run. This stops hackers from injecting scripts into a website through such things as dodgy adverts and such.
If you have a "Same Origin" on such things as AJAX calls, then the server will only honor requests for AJAX calls that come from the domain of the website that the AJAX server is associated. This prevents other sites from erroneously calling your AJAX routines.
So it's basically to try and ensure that requests and scripts come from the correct locations and aren't being replaced or introduced by hackers.