Recruiter and former CTO here. References are a box-ticking exercise that you pay someone like Experian to do, so that you can say it was done as part of a security review.
I think the "references" under discussion here are actually phoning up former colleagues/managers for more detailed questions.