We have clients (regulated banks and insurers of various sizes) that send us feeds via SFTP. You might be surprised what proportion of them ignore our “we strongly recommend key based authentication” and ask for password auth instead.

If you run a cockpit service on your server you will need password authentication enabled, unfortunately.

it's the default for most systems. I can't remember a time I had to not turn it off.

People who use AuthenticationMethods "publickey,password"

You must present a key first after which you must enter a password.

As this is apparently affecting openwrt, probably a fair number of openwrt users, if I had to guess