It's a property that just contains the result in plain text. The first argument, data, holds the parsed XML as an object. If you switch the format in the URL to json, giantbomb's API will return json rather than xml and jQuery's ajax call is clever enough to then parse it as json, meaning that data will hold the parsed json object.
There might be a problem with their API, I don't know, but just to prevent misunderstandings: An API key of "[KEY]" will of course return an error and if you try to execute this code on a page that does not allow cross-domain requests, it also won't work. You can test it simply by going to giantbomb.com, opening your browser's development console (Ctrl+Shift+J in Google Chrome) and copy/paste that code in there (executing it on giantbomb.com won't be cross-domain). It works fine for me (but, of course, returns an error due to the key).