Alpine matches the first.

Disabling PAM has been "generally good security advice" for decades; I remember suggestions to not use it in the 2000s.

Password logins are often enabled, especially on multi-user and default setups.

If alpine uses the * feature, it's going to be pretty common. Gentoo has it, as does Ubuntu.

If password logins are enabled, you're almost guaranteed to have at least one user with a password (root on all my boxes has one, even if I never use it and it's random garbage).

So the cheese lines up pretty well, this affects quite a bit.

If password logins are enabled, someone almost certainly has a password.