If you do a search on "input output forward" or similar, you'll probably find some more in-depth discussion of the operation of the firewall. But fundamentally, output controls the ability for traffic to flow out of the firewall zone and thus out of the related interfaces. In the case you describe, setting output to drop or reject means that traffic cannot flow out of the wan interface at all (although this could be coupled with additional firewall rules to permit traffic to egress provided that it is explicitly defined in those firewall rules, all else would be blocked).
The other part of the equation is that the opkg requests are obviously initiated from OpenWrt (as an OS)... so for this, you have to remember that the firewall sits between OpenWrt (as a host OS) and networks to which it is connected, even though the firewall is running on OpenWrt. opkg (or even ping or other applications/services running on the router) initiates traffic, but that traffic is sent through the firewall before it goes out to the network(s). Thus, if traffic is not allowed out of the firewall on a given zone (output), no connections can be made on that zone.
Input, on the other hand, is traffic initiated from outside the router/firewall that is destined for the router itself. For example, when you connect with ssh or a web browser to your router, that traffic is being initiated from a host on the LAN that is intended for the router itself. If input is dropped or rejected, it would not be possible to connect to the router (except if coupled with other firewall rules to explicitly allow certain traffic). On the WAN zone (or any similarly untrusted networks/zones), input should always be dropped or rejected.