It's only an issue if you have password authentication enabled, which shouldn't be the case on a production system.

The very first things I do whenever I set up a server are copy my SSH keys across, verify they work in a new SSH session, then disable PasswordAuthentication in the SSH config.

In addition to needing password auth enabled, a user has to have a literal asterisk as a placeholder password hash in /etc/shadow, and PAM must be disabled or not installed. All these things combined are very rare on production servers. This is the case on Alpine Docker containers, but it's very rare to SSH directly into a Docker container, since Docker containers are supposed to be small and only run one thing.

If you really need password auth on a production server, you should really be using two factor auth, and simply setting up a 2FA module without even using it would help (since it needs PAM).