The reason is to protect the innocent, of course, they're mostly clueless about security! But I don't know the level of practical benefits for this measure, superficially seems to be rather low, but then (assuming silly usability issues like "appears frozen" are fixed) what's the downside?

Millions of desktop users would use empty password if they could.

Most of them would be well enough served by that too. It used to be normal and perfectly suitable for most home users.