What exactly does the scary option "Allow incoming connections" do in Bitcoin Core?
There are two ways by which bitcoind connects to peers.
The default is purely outbound connections - the node will use DNS seeds, as well as its own database of previously seen peers, and attempt to establish connections to them as needed (upon startup, or when existing connections are closed).
Allow incoming connections allows you to return this favour - it lets other peers initiate the connection to your node, instead of all your connections only being with peers where your node initiates it (of course, on the other side of those connections, is a node with Allow incoming connections enabled).
These peer connections are used for syncing network state, such as blocks, transactions, and information on other peers.
Barring a catastrophic flaw in bitcoind's implementation, this is not a security risk.
Depending on your network setup, you may need to enable port forwarding in your router and/or local machine's firewall before enabling this option has any effect.