How internal search pages work
When a visitor types into the search box on your own website, the result is a page with its own address, usually carrying the query as a parameter. Those addresses behave like any other page: if something links to one, a crawler can find it, and if nothing stops it, it can be indexed. Internal search pages are those result URLs.
They are generated on demand, which is what makes them different from the rest of the site. There is no fixed set of them. Every query anyone has ever typed, including nonsense and deliberate spam, can produce a distinct URL, and the content of each is assembled from the database at the moment of the request.
Why internal search pages matter
Two reasons, pulling in opposite directions. As a search problem they are one of the classic sources of low-value indexed pages: unlimited in number, thin, duplicative of the category pages you actually planned, and occasionally exploited by spammers who link to a query designed to make your domain display their text.
As a business signal they are among the most useful data you own. What people type into your own search box tells you what they expected to find, in their own words, including the products you do not stock and the terms your navigation does not use. It is keyword research from people who are already on the site and already interested.
Where internal search pages go wrong
Leaving them indexable is the default fault, and the symptom is a page indexing report full of search URLs nobody created on purpose. Because they usually duplicate a category page, they compete with the page that was meant to rank while adding nothing new. Search engines have long treated search results inside search results as a poor experience, so a site publishing many of them looks weaker than it is.
The spam variant is worth knowing about. Someone links from elsewhere to a search URL on your domain containing text they want associated with you; the page renders that text, gets crawled, and your site is hosting it. Printing the raw query onto the page without escaping it makes the problem considerably worse.
Getting it right
Set search result URLs to noindex while still allowing links on them to be followed, so they stay out of the index but a visitor or crawler can move on to real pages. Do not link to them from navigation, footers or the XML sitemap. Blocking them in robots.txt instead is the common instinct, but that prevents the noindex being read, so it belongs as a later step for paths that must never be crawled.
Then use the data. Read the internal search queries in your analytics, look for the terms that return nothing and the terms people repeat, and turn the frequent ones into real category pages or product listings. Handling these URLs correctly sits beside filter and parameter decisions in technical SEO, and the query log is one of the cheapest research sources a shop owns.