We can assume that if an attacker gained access to a web server running mysql that they would be capable of reading the scripts to determine the mysql password.
If mysql only responds on localhost, does it really need a strong password?
Sure, if there was an exploit on the server which allowed an attacker to upload and run PHP files, they could wreak havoc on the database if there wasn't a secure password. However they could still use that PHP file to access the 'real' server scripts, send them to the client, then read the password that way.
I really don't understand the need for a mysql password if it only responds to localhost. Why is it important?
When I say 'no password' I mean leaving it as the default value of 'password' which is probably the first guess for an attacker