I happened to ask the same from Odoo Support. I tested what they answered and it's correct.

"The default behavior is that if the recipient of the quotation email is NOT on the Customer field, then they would have to log in to see it.

However, if the recipient is listed in the customer field, then they don't have to log in to view the quotation because the email button will contain the link that includes the access token.

For security, the access token is only provided to recipients who set in the Customer field. If the customer is using a different inbox than the email address listed on the quotation, then they will need to log in."