There are two new features: Device Verification (on by default) protects your sites from logins on new devices and Email 2FA, which you can additionally enable in settings - this enforces codes for every login.
Ghost lacks a lot of features without SMTP mail configured, including inviting staff, password resets, email notifications and more, as well as this new security feature.
There’s definitely some rough edges for us to iron out around making it easier to check and get SMTP configured - we’re working on those. In the meantime there is documentation here: Configuration - Adapt your publication to suit your needs
If you really prefer to go without, you can disable Device Verification here: Configuration - Adapt your publication to suit your needs - this will also disable the ability to enable Email 2FA in settings.