I think this is a matter of semantics.

I read it as saying if you want your site to be secure then it is mandatory to have password
Not that it is mandatory to have a password on your database

It should be clear then - and not open to being interpreted incorrectly.

If this was something in the last ten years we had people questioning I
would agree but that's not the case.

Until the likes of xampp stop being idiots and making it hard to set a
password and username then making this required is going to make it much
harder for users to try out Joomla locally.

Feel free to submit a pull request you know how to I think :)

Yes I know how to waste time on pull requests that no one wants to consider only for it to be ignored and a waste of my time.

The whole "submit a pull request and if we like it then we will use it if we disagree with the slightest thing, or just don't like you, then thanks for spending hours on code, but we will just close the request, with no thanks" development process is flawed and a waste of good developers time.

I've lost faith in random Speculative Pull Requests as a development process. Just like a lot of developers.

Joomla's development is stalled because of the Speculative Pull Request development process. Hours of good developers time has been wasted on pull requests.