It does not do anything with your Windows account or with your Windows password. It is just there to verify that it is really YOU in front of the PC. (Full story below)
The Full Story
Thanks to the comments by @Ramhound, I was able to refine my web search to include Firefox, in addition to Thunderbird. That turned up more search results. Here's what I found out:
First of all, Thunderbird (and Firefox) stores all your stored
passwords unencrypted[Note 1] on your hard drive.
Before Firefox 76, anyone using your PC could open the
Firefox/Thunderbird settings and click Show Saved
Passwords to reveal all your secrets without any access
To prevent that, Mozilla developers added that Windows account
password prompt that this question is about. When you click
Show Saved Passwords, it will now ask you for your
Windows password, to prevent people from casually looking at
your passwords while you are away for a second. For example your
(hypothetical) nosy colleagues when you forget to lock your PC
while getting a coffee.
The Windows account password is not used for anything other than
making sure that the user in front of the PC is really YOU.
It is not used to encrypt your stored passwords or doing anything
related to security. Anyone with access to your account can still
read all the unencrypted passwords from your hard drive, if they
know where to look.
Riadh Chtara wrote:
[...] In the current bug we dont change how the password are
stored, we just use an api to ask him for his windows password: it s a bit
cheating so the normal users feel more secure, and he is indeed more
secure against normal people attacks, however in the a background:
advanced user can still get the passwords. [...]
Corollary: This feature is less secure than locking your PC. [Note 2]
Creating a Primary Password[Note 3] is the same as accessing all your
stored passwords, because all your existing (unencrypted) stored passwords are
transferred to the new encrypted Primary Password storage. From now on you
will need to enter your Primary Password instead of your Windows password
when clicking Show Saved Passwords.
So in order to prevent your (hypothetical) nosy colleagues from bypassing the
Windows password prompt by setting Primary Password, Firefox/Thunderbird
needs to ask for the Windows password before it lets you create a Primary Password.
Jared Wein wrote:
The OS auth before setting a Master Password is required since
having a Master Password set will supersede the OS authentication.
My Personal Conclusion
This feature is just there to prevent
the most basic attack by the most unskilled attacker imaginable. And to
annoy its users, apparently, because Mozilla quickly disabled the feature after
the initial release of Firefox 76 due to a user outcry. Apparently it
was now reintroduced (at least to Thunderbird, I don't use Firefox so I
Note 1: Okay, technically they are encrypted, but the encryption key sits right next to the encrypted passwords in your profile folder. So anyone with access to your user account has access to your stored Firefox/Thunderbird passwords. Unless you set a master password.
Note 2: Additionally, it's a very poor design decision to ask for the operating system password for anything but signing in to the operating system. If you teach users that it's okay to enter the their Windows password in their web browser, you open the door for all kinds of scams. Websites could easily fake this Windows login prompt. And yes, scientific studies have been done on exactly that topic, where up to 20% of unwitting users fell for that ploy.
Note 3: It is now called Primary Password, instead of Master Password because of the origin of the term "master".