The pi is meant to be setup to a TV or monitor with a keyboard and mouse for a full interactive login. You need some way for a human to type in authentication.
Of the 20 or RPis I’ve used over the years, I think only my first one ever got plugged into a keyboard and display. All the others were setup with ssh only.
If there's no password login doesn't prompt for one (you immediately get a shell after entering the user name) and ssh won't let you login. Removing the password is the correct default for interactive login on GNU/Linux unless you set up PAM.