The Case of the Unexplained FTP Connections

Does SQL Server still install with sa enabled and a blank password? Does it even allow blank passwords?