Most likely it is because you are currently accessing from an IP that is within the Trusted IP Ranges (Setup -> Administer -> Security Controls -> Network Access) and Salesforce hides that option in that case.

That might explain why it is not displayed, but you can still access through the link. Just put /_ui/system/security/ResetApiTokenEdit after https://......force.com

Or... (while it still works the redirect if you don't have my-domain enabled and so on)

• https://login.salesforce.com/\_ui/system/security/ResetApiTokenEdit for production / developer orgs

• https://test.salesforce.com/\_ui/system/security/ResetApiTokenEdit for sandboxes