CA certificates must include it, marked critical, with cA set to true (RFC 5280 §4.2.1.9); end-entity certificates either omit it or set cA to false. pathLenConstraint: 0 means the CA may issue only end-entity certificates.
Verifiers that ignored this extension let any leaf certificate act as a CA: Moxie Marlinspike's 2002 sslsniff showed that Internet Explorer accepted certificates signed by an ordinary site certificate, and the same class of bug has resurfaced in embedded TLS stacks since. It is one of the checks to confirm when choosing a TLS library for constrained devices.