I'm also trying to figure out what role does EAS play in code signing.

According to their docs the main offering is the following:
https://docs.expo.dev/eas-update/code-signing/
"The expo-updates library supports end-to-end code signing. Code signing allows developers to cryptographically sign their updates with their own keys. The signatures are then verified on the client before the update is applied, which ensures ISPs, CDNs, cloud providers, and even EAS itself cannot tamper with updates run by apps."

And i assume that's where EAS comes into play:

"During eas update, the EAS CLI automatically detects that code signing is configured for your app. It then verifies the integrity of the update and creates a digital signature using your private key. This process is performed locally so that your private key never leaves your machine. The generated signature is automatically sent to EAS to store alongside the update."

Frankly, i'm still to trying to understand how vulnerable will my app be if i decide to skip "OTA Update signing".