The trick here is you seem to need to run that test twice to catch the error. As I read things - the first time you try to log in as root with an empty password, it creates the root account (but doesn't log you in) - the _second_ time you win.

The question (and the bug) seems to be why is it creating this account in the first place

Oh sure. But there's a very plausible explanation why "the obvious test" might not have caught this bug...

If your testers only test the obvious things you're screwed.

You can't ensure correctness by testing. You can only hope to find some of the bugs.

This one in particular doesn't strike me as something that the testers should've caught. It's something that the development process shouldn't have allowed to happen, in the first place.

In my time as CTO in different companies, this would be something testers would have tested, perhaps not at the first release but over time.

Especially if QA does exploratory testing[1] instead of defined test cases (which should be automated away anyway).

[1] https://en.wikipedia.org/wiki/Exploratory_testing

Yes. Testers usually just test for regressions. Bugs once fixed should not reappear again. The rest is pure luck.

The standard password dialog certainly needs to be tested with repeated password entry as it will display the account password 'hint' at (I think) the 3rd unsuccessful try.

There is /no excuse/ for this unbelievable security hole. Total fail on Apple's part.