Actually it's so you can track multiple domain with one code. I do this with subdomains so that I can see all my traffic as well as by individual subdomain.

Hello User #1122111, we see you are trying to track potatoes.example.com , would you like to show this?

Y/N

It probably doesn't come up all that often.

Great, which means most users will never see the message when someone adds their tracking code.

It doesn't happen that much, so "most users" is going to not be very many users.

I thought they asked for verification. Or was it only for webmaster tool?

And even so I supposed after the verification step the code is active so anyone could use it. Does GA code ever expire?

Sounds like an expiration date would be a reasonable solution plus a way for the account holder to deactivate the code from admin panel.