Why are VPP tokens dependent on Apple ID password?

When the Apple ID password is changed for an account that is associated with the VPP (Volume Purchase Program), the token for VPP also changes, why is that? And what affect could that have on any VPP apps that were already installed via an MDM server that would now have a revoked (obsolete) VPP token?

I wont believe the token would be revoked. The previous token should still remain valid. You can easily test that by quickly call some of the VPP api using a rest client.

Why are VPP tokens dependent on Apple ID password?
 
 
Q