I'd say it happened because invoking a ROOT USER is something only 1 in 10,000 Mac users ever do, and when they do it, they only need to do it once.
It is not something that is ever done repeatedly. Ergo, a Mac user who might need Root will go in to activate it and click on Enable Root, then they'd add a root user password and then hit the Enter button.
They most likely would never even notice that there was already an existing user with a blank password.
Nah...there’s something much worse about this scenario.