The audience check stops a token issued for one service from being replayed at another that trusts the same issuer. In OpenID Connect ID tokens aud is the client ID; in OAuth access tokens it is typically the resource server's identifier (RFC 9068 requires it), and resource indicators (RFC 8707) let clients request a specific audience.
Libraries differ: some check aud only if the caller supplies an expected value, so forgetting the option silently disables the check. Values are case-sensitive and compared exactly; an array audience is acceptable if any element matches.