From what I can tell, it causes the camera to tell a UPnP enabled router to establish port forwards for the camera. Assume you're camera has local IP 192.168.1.7 (via DHCP), and that you've left the camera ports with the default values (HTTP on 80, HTTPS on 443). The camera will tell the router to forward all unsolicited incoming requests for ports 80 and 443 to 192.168.1.7 (same respective ports).
More complex situations probably have to be done manually in the router. For example, suppose we had 2 5020's (with IP's .7 and .8 ), and we wanted both to be accessible from the internet, but only via HTTPS. Well, we can't explicitly manage the HTTPS port via the firmware, so that means that either both cameras will be listening on 443, or (somehow one will figure out to listen on some other port - that isn't obvious to us). Assuming both cameras are listening on 443, we'd need to be able to sort it out in the router.
We could setup 2 port forwards - one for requested port 4431 which could be mapped to the first camera (192.168.1.7) port 443, and one for requested port 4432 which would map to .8 port 443. I suspect that there are some routers where doing this would be difficult (if not impossible). I do not think that the camera build in feature "enable UPnP port forwarding" will handle this sort of thing. We wouldn't setup port 80 forwarding at all (because we don't want to be able to get to the camera without HTTPS).
Of course, I do NOT have two 5020's so much of that last part is conjecture.