Why does touch call the dup2() syscall?
It's a historical artifact.
The open()+dup2() pattern comes from the fd_reopen() function, which is used by several of the programs in the coreutils code base.
Prior to coreutils commit e373bb1, fd_reopen() did not do open()+dup2(), but closed the desired file descriptor before opening a new one. This was the case when touch started using this function at coreutils commit 478bd89. Per that commit message, the intent was to reduce the number of file descriptors touch would have open.