Why can I sign in to my account just by confirming my phone number without entering my password?

You can sign in to your VK ID account with your password or with a code sent to the phone number linked to your account. If signing in with a code is an option for your account, you'll see the Confirm by phone number button at the bottom of the sign-in window after you enter your phone number. If the code was sent immediately, you can sign in with your password. To do this, press Sign in using password.

Note that this option is different from 2-step verification.