Comment 1 for bug 1488397

the settings backend has this code/note

" QDBusReply<void> reply = iface.call("SetPasswordMode", newMode);
    if (reply.isValid() || reply.error().name() == "org.freedesktop.Accounts.Error.Failed") {
        // We allow "org.freedesktop.Accounts.Error.Failed" because we actually
        // expect that error in some cases. In Ubuntu Touch, group memberships
        // are not allowed to be changed (/etc/group is read-only). So when
        // AccountsService tries to add/remove the user from the nopasswdlogin
        // group, it will fail. Thankfully, this will be after it does what we
        // actually care about it doing (deleting user password). But it will
        // return an error in this case, with a message about gpasswd failing
        // and the above error name. In other cases (like bad authentication),
        // it will return something else (like Error.PermissionDenied).
        return true;"

That's a good point, you had the user in that group likely because your device is rw, that can't happen with a "normal" ro image, still an issue but probably not an high one