It seems to be a recurring theme that some people are dead set to add passwords to password less system accounts on Linux "because its more secure". I currently have regular discussions with customers about this. They themselves do not understand much about IT, however they have security experts scanning their systems and then have the finding that "that account does not have a password".
To my understanding, the contrary is the case. An account that does not have a password has one option less to authenticate. Or viewed differently, if there is no password, it cannot be brute forced. Do I miss anything? Is there any security benefit in adding a password to an account that technically does not need a password?