As the sentence prior to the statement says: “It is possible to configure the VCS root to match the incoming pull request branches and TeamCity will start the builds automatically.”
So if you use +:* , the incoming PR branches will be detected and the builds will automatically start. That is a security issue – you better not start the builds automatically for the PRs that come from the external contributor.