An object is any piece of data the API gives you access to. Your user profile is an object. Your order is an object. Your workout history is an object. Every object has an ID — a number or code that identifies it specifically.
Level means the specific one. Not just "orders" in general — order number 1042. Not just "profiles" — profile number 8831. The level is the individual item, identified by its ID.
Authorization is the check that asks: "Is this person allowed to access this specific thing?" It's different from authentication (which just asks "who are you?"). Authorization asks "what are you allowed to do?"
The check isn't happening. The API knows who you are. It just doesn't check whether you're allowed to access the specific object you're requesting.
Broken Object Level Authorization = the API doesn't check if you're allowed to access the specific item you asked for. It just gives it to you.