MySQL should never have a default password for root and their install should never allow it. Thats just ASKING for a worm.
The installer now does ask you for a new password. Earlier ones just defaulted to "root." Still, you're right, it shouldn't be allowed, but I think it's common practice, as MSSQL does it too.