Adding a password to the user account creates another vector for exploitation... basically, you are weakening the existing security by adding a password to an account that currently cannot be logged into.

Use the public/private key method outlined above and you can also disable logins on root eliminating all possibilty of someone gaining access to your device by brute force.

Unlikely to happen I know, but some people are paranoid and sometimes with good reason, however I would certainly argue against adding a password to "user" under any circumstances.