Why is it important to check for isset and is_array before checking in_array in this example?

Because only the first parameter is required, and $user might be a WP_Error object if the person trying to log in isn’t a valid user.

$user
(WP_User or WP_Error) (optional) WP_User object if login was successful, WP_Error object otherwise.
Default: None