A layer architecture is standard practice which makes the code base easier to maintain. Since you are following a tutorial perhaps ask the author?
Why separate data access from the controller?
The data access library can be used by other clients. Plus the coding pattern is easier to test and update.
Why the Services ?
Testability. You can test the service without having to make an HTTP request to a controller. If there is a change to the business logic then only the service needs updating and the controller is not affected or vice versa.
What is the point of DTOs?
The user interface might consist of five tables. Rather than implementing five different HTTP requests a DTO can bundle the five datasets.
How to implement Unit test code for this ? Test must be run on a test DB, not on the prod, right ?
Depends on what you're testing. If you are testing the DB then the test is NOT a unit test but an integration test.