At least in the early days of EC2, there were more than a few higher profile AMIs with password logins enabled, e.g. some of Oracle's AMIs used a trivial default password.

As far as I know, you can still create/publish AMIs where password auth is enabled, but all of Amazon's stock images only allow ssh-key auth.