SFDX uses OAuth, which is a browser-based authentication. Logging in to the UI is a browser-based authentication. Once you've logged in, you don't need to "activate" the browser again. If you've ever had to check your email or phone for a five digit code to log in, that's the alternative to Security Tokens for non-API logins. Browser-based logins never require a Security Token.
The API, including the Apex Data Loader, ANT Migration Toolkit, etc, uses a different authentication mechanism. You can't "activate" an API login, so a different mechanism is in play. A randomly generated 25-character extension to your password. You only need this for API logins, not browser-based logins. If you're not in the "trusted network", Security Tokens apply to you for all API logins. Browsers don't use this because they get a special authentication cookie that remembers that you've authenticated before from that browser. Try deleting your cookies, and you'll find you probably need a new 5-digit code sent to your email or phone.
You need to either use the Security Token (you can go in to Personal Setup to generate a new one), or add your IP address to the Trusted Networks area in Setup. Either way, you will need to take some sort of action to fix the problem. The system is working as designed, and you must follow the rules in order to use the API.
And yes, this applies from Sandbox to Sandbox. If you've never logged in from a given IP in a particular Sandbox, you'll need your Security Token, even if you've logged in to other Sandbox environments before. Each new org requires this. There's a special feature where the first IP you log in from in a given org is automatically "trusted", but if your IP address changes, or if you've never logged in before, the Security Token will be required until the IP is trusted by adding it to the Trusted Network settings.
