Hi,
In short: It’s a remote configuration protocol / engine (in fact it’s not, TR-069 is just the name of the standard released by the broadband forum, but that’s just a detail). An ISP can auto-configure thousands of devices using an ACS (auto configuration server), so TR-069 enabled ISPs to mass deploy devices without the need of service technicians.
On the other hand, it used to be a security vulnerability if not properly implemented on both sides (CPE and ACS).
Reference to this:
https://media.ccc.de/v/31c3_-_6166_-_en_-_saal_6_-_201412282145_-_too_many_cooks_-_exploiting_the_internet-of-tr-069-things_-_lior_oppenheim_-_shahar_tal#video
Ape