"passwordless" here means that the account doesn't have a password. What the person you're replying to means is that password authentication should be completely disabled in the SSH config, as that's the only way to exploit this issue.

But passwords need to be enabled for SSH. You must submit a faulty password of a specific kind, and the SSH server misinterprets it for passwordless accounts, which means the server must be configured to allow you to attempt a password.

not true. regardless if all your user accounts are using key based auth or not, some system accounts will always be passwordless, because they are not supposed to be logged into.