To 'passwordless-root' or not to 'passwordless-root'?

Consider a GUIX overlay to a Debian template for your service VM’s. My Net-sys, Firewall-sys…etc all are passwordless and I remove both Nautilus and Firefox… You can do a lot of other things to make them secure. Use disposables… I can go on and on…