Think of it as process maturity. They don't want to just rubber-stamp some company's project as a "CNCF" project, only to have it collapse when the company pulls employees off it.

As a gatekeeper (and as a result, status, attention, prestige, etc.)

Funding can be attained more readily if you have a project that reaches any of these stages.

Also a lot of projects in sandbox or incubation are “finding themselves” so to speak. It’s what used to happen when a project would release a v1 that’s really mostly a POC, then have some major overhauls/rewrite in v2/v3. At least in theory by “graduation” or v3, you know that this thing has a non-trivial user base, fairly defined in what it does and how it does it. Some independent reviews and established patterns etc.

Nothing protecting them from rotting or dying or breaking obviously, but at least you know you won’t be shouting at it alone.

Sort of. It's also a statement of maturity.