Is this a Mosquitto MQTT anomaly or a bug?

Having been through the pain of a complete system rebuild following the MQTT débâcle, I today noticed that a few of my Sonoffs weren’t working. They had my old, pre rebuild, MQTT username and password (because of the rebuild).

I changed the username and password to my Home Assistant login and they began working again.

What I find odd is that in my MQTT add-on config I have NOT set a username and password.

Is this how it is supposed to be working?