After seeing your original post here, I also asked for clarification, and received a similar reply from support:

  The Lish password is set to a random string by default, however we would still recommend resetting this password even if you had not set one manually previously.

I had expected that if the password was not set, then password auth was disabled. I've told them that's what I want and have asked when it will be implemented.