Correct, password authentication must be enabled on the SSH daemon side of things to be vulnerable. The user account being logged into, on the other hand, can't have a password set. But overall, PW auth must be on. The website OP linked is exceedingly bad at explaining the actual problem, see Alpine's announcement for better info.
https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/
