For the above-mentioned reasons, passwordless login is not enabled by default. But you may have either chosen that on installation, or enabled it afterwards, the latter either via GUI, if an option is available there, or via command line. Eventually, you may find yourself unable to disable it again, either because there is no option available in the GUI, or because you cannot log in to your desktop anymore in the first place. So, to disable the passwordless login from the command line, either in a Terminal or at the CLI/tty, just run this command:
sudo gpasswd -d <USERNAME> nopasswdlogin
Notes: Technically, that removes the concerning user from the group "nopasswdlogin". Replace <USERNAME> with the respective actual username, obviously.
The only case where passwordless login would be needed, at least if using LightDM as of now (because of this bug, is if there are multiple users using the same system, and the concerning user/s don't want to enter their password/s each time on login. If that's the case, make sure that at least all these conditions are also met: The concerning user/s ...
- are fine with anyone using the system having complete access to their account (same as with auto-login),
- don't have an encrypted home directory (would lock them out of their desktop completely!),
- don't ever want to change the desktop session option the log in to (at least not in an easy way),
- are fine with possible keyring password queries after login (same as with auto-login).
sudo usermod -a -G nopasswdlogin <USERNAME>
Notes: Technically, that adds the concerning user to the group "nopasswdlogin". Replace <USERNAME> with the respective actual username, obviously.