esc_html__ security : what for in this example?

It really doesn’t do much in that scenario. If you’re going to leave that message as a string constant instead of something that is system or user generated, you’re fine using one of the other translation functions: __() or _x(). esc_html__() is a little overkill for that particular line of code.

Edit:

The main reason for the esc_ functions is to protect your site against bad input, either intentional or accidental. You’re going to want to use the appropriate function whenever you’re working with any data that can be manipulated by a user or is not explicitly set by you.

If you have any questions about WP functions in the future my recommendation would be to check the source. Either do a search in a WP install to find the function, or click the link at the bottom of the codex page that links to the source file.