The exploit works for a user account that has no password. This is often confused with turning off password auth, especially in containers that have only one usable account.

It's not just the parent commenter. I'm sure somebody out there is going to remove their account password instead of editing their sshd_config in an attempt to "patch" this vulnerability, actually exacerbating the problem.