A whole bunch of projects suffer from the issue - even (especially) ones as large as FreeBSD[0]. The issue usually winds up being that some minor contributor - or even just someone who hangs around in the dev channels - harasses some specific woman/trans person/other minority member, and the project has no official framework in which to approach this issue. Often in the project leaders' eyes, the project leader's job is all about code, not community management, leading to a call of "sort it out yourselves" when it's brought up to them - which is essentially a signal that the project will allow its contributors to harass each other without repercussion.
Basically - the sorts of people who women have to get conference organisers to have a quiet word with and/or ban don't stop being assholes on the Internet. If anything, they become worse, and it's easier to hide that behaviour when it winds up being in large part through private messages and communication systems other than the project's official ones.
(If you were associated with a volunteer group irl, and you started harassing your co-volunteers through Facebook and email and text messages, you'd hopefully be kicked out. Various CoC debates show that many people think that if the volunteer group is online, such behaviour should be excused.)
A Code of Conduct isn't magic, but it does provide social proof that the project leaders at least thought of the issues that can affect their contributors, and can provide a yardstick to judge whether a project is likely to at least listen about issues affecting contributors who are members of minorities.
[0] https://blog.randi.io/2015/12/31/the-developer-formerly-know...
