The main function is to obscure whether a package has been left or not, since the master keys were available online before An Post starred selling the boxes. Some DPD drivers use them too.

Physically, they're about as secure as an Amazon cardboard box.

A small level of friction can reduce a lot of issues though. Without being able to tell that a package has been delivered they have to break into or open random boxes and hope there's a package inside increasing the chances they're caught and wasting their time. It's the same kind of thing proof of work anti spam measures can work under, it adds a tiny friction to legitimate users but illegitimate users have to do tons of work to send their spam or in this case open a lot of boxes.