Due to a configuration option, users are able to create user accounts which have no passwords, which can cause issues logging in.
It is also not a good idea to have your root account have no password. I think it’s a good idea not to allow this configuration out of the box, so new users don’t run into unexpected problems.
You are correct, and we are aware of the problem, yes. The next official Stable.iso will no longer allow for empty passwords.
The people who develop Calamares ─ i.e. the installer, which is also used by other Arch derivatives than Manjaro ─ have already made the necessary changes to the code, so it’s only a matter of time anymore.