"passwordless" here means that the account doesn't have a password. What the person you're replying to means is that password authentication should be completely disabled in the SSH config, as that's the only way to exploit this issue.