Why staff sign-in needs a check at all

WHMCS publishes a supported call for validating a client password, and none for validating a staff one, so the app has to read the stored hash itself. Where that hash lives changed between WHMCS versions: older installs keep it on the admin row and sign staff in by username, newer ones link the admin to a user account and sign in by email. The check reports which arrangement your install uses and whether the app can work with it. If it says no, that is a gap in this module rather than anything you have configured wrongly.