solana-program-library | A collection of Solana programs maintained by Solana Labs

To answer your questions...

Does that mean any Solana program can transfer any user's tokens without their consent?

That would be quite a security flaw! The concept is that, when you transfer tokens, some account must sign to validate the transfer. That account may be the owner, or some pre-approved delegate. In the exsample that you've shown, authority is given as ctx.accounts.owner.clone(), which means that the owner has likely already signed the transaction. If the owner approves some amount to a delegate, and then signs with that delegate, the token program figures out that the delegate has signed, and allows the transfer.

Why does the approve function exist if we cannot check the allowance?

To check the allowance, you'll have to deserialize the account into a token Account https://docs.rs/anchor-spl/0.19.0/anchor_spl/token/struct.TokenAccount.html. You can use one of the helpers, like try_deserialize, which gives you a type that wraps spl_token::state::Account.

With your spl_token::state::Account, you can check the delegated_amount field to see how much has been approved by the user: https://github.com/solana-labs/solana-program-library/blob/8eb2c3ce60bfe943e277eb172ba8e9ce9b6bdae6/token/program/src/state.rs#L103