Narrowing where the real value has to exist at all
Tokenization replaces a sensitive value — an account number, a credential — with a non-sensitive substitute token usable throughout most of a system exactly as the original value would be, while only one specific, tightly controlled component retains the ability to reverse the token back to the actual underlying value. Everywhere else in the system handles only the token, which carries no risk if it leaks, because it's worthless to an attacker without access to that one narrow reversal capability.
This is a structurally different strategy from trying to protect the sensitive value everywhere it might conceivably be handled across a large system. Rather than needing every component that touches the value to independently get its protection right, tokenization concentrates the actual protection requirement onto one narrow, specifically hardened component, and every other part of the system becomes irrelevant to that value's actual security.
The reversal capability is now the entire remaining risk
Because tokenization concentrates risk this deliberately, the one component that can reverse a token back to its original value becomes, by construction, the single highest-value target in the entire system for that data — every bit of exposure the tokenization scheme removed from everywhere else is now concentrated onto defending that one component well. This is a worthwhile tradeoff precisely because one narrow, well-defended component is considerably more tractable to secure thoroughly than the same sensitive value scattered across many components each requiring independent protection.