What the token actually is
When a bot is created, Telegram returns a string with a number, a colon and a long random tail. Every request your software makes to Telegram carries that string, and Telegram uses it to decide whether the request really comes from your bot.
There is no second factor and no separate password. The token is the whole of the authentication, which is why the way you treat it matters more than any other setting on the bot.
The number before the colon is the bot's own id and is not secret. The tail after it is.
What someone with your token can do
Everything your bot can do, which is the part people underestimate. If the bot is an admin in your channel, a stranger with the token can post as you, delete messages, and remove members. They can also read whatever the bot receives, which in a group means the messages it was added to see.
None of this looks like an attack from the outside. It looks like your bot behaving oddly, which is why leaked tokens are often noticed late, after the third strange post rather than the first.
The damage is also not limited to what happens next. A bot that posted a scam link to your members has spent trust you built over a year, and no amount of explaining afterwards gets all of it back.
Where tokens leak
Almost never through Telegram. They leak in screenshots posted for help, in code pushed to a public repository, in a message to a developer who then leaves the project, and in a support chat with somebody who asked nicely.
The pattern is the same each time: the token was treated as a setting rather than a secret. It sits in a config file next to the colour scheme, so it gets copied around with the same care as the colour scheme.
Public repositories are the most common of these and the easiest to prevent. Anything that looks like a token should live in an environment variable and never in a file you commit.
What to do if one leaks
Revoke it. In BotFather, generating a new token for the bot invalidates the old one immediately, and anything still using the old string stops working. Do that first and work out how it leaked afterwards, in that order.
Then check what happened while it was out: recent posts in your channel, recent removals from the member list, and anything the bot sent that you did not write. Revoking closes the door but does not undo what came through it.
How a platform should hold it
If you hand your token to a service, it should be encrypted at rest rather than sitting in a database in plain text, and it should never appear in a log line. On BotLaunch, bot tokens and other sensitive data are encrypted at rest with AES-256, and you can revoke and replace a token at any time from BotFather without losing your setup.
It is a fair question to ask any platform before you paste anything, and a platform that cannot answer it clearly has told you something.
When you do not need one at all
Most people never touch a token. On BotLaunch you add the shared bot to your channel as an admin and turn modules on from the web, so there is no bot to create and no token to hold. Connecting your own branded bot, which is where a token comes in, is a paid-plan option for people who want their own name on it.