Basically - the sorts of people who women have to get conference organisers to have a quiet word with and/or ban don't stop being assholes on the Internet. If anything, they become worse, and it's easier to hide that behaviour when it winds up being in large part through private messages and communication systems other than the project's official ones.
(If you were associated with a volunteer group irl, and you started harassing your co-volunteers through Facebook and email and text messages, you'd hopefully be kicked out. Various CoC debates show that many people think that if the volunteer group is online, such behaviour should be excused.)
A Code of Conduct isn't magic, but it does provide social proof that the project leaders at least thought of the issues that can affect their contributors, and can provide a yardstick to judge whether a project is likely to at least listen about issues affecting contributors who are members of minorities.
[0] https://blog.randi.io/2015/12/31/the-developer-formerly-know...
Is a big part of the problem. A lot participants don't want to be seen to be rocking the boat so they let stuff slide that they really shouldn't in the effort to not be "that person".
A formal code of conduct gives people the support up front to come forward with complaints about other members.