It's to prevent the shell from (mis-)interpreting the square brackets.
e.g. if there is a file named tcp1 in the current directory,
with tcp[13] == 2, the executed command will be:
tcpdump -i xl0 tcp1 == 2
Result: tcpdump: can't parse filter expression: syntax error
[skip ci]
.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
.\"
-.TH TCPDUMP 1 "20 September 2023"
+.TH TCPDUMP 1 "21 October 2023"
.SH NAME
tcpdump \- dump traffic on a network
.SH SYNOPSIS
to watch packets which have only SYN set:
.RS
.B
-tcpdump -i xl0 tcp[13] == 2
+tcpdump -i xl0 'tcp[13] == 2'
.RE
.PP
The expression says "let the 13th octet of a TCP datagram have