The most charitable interpretation here is that musl authors are incompetent.

There is simply no universe in which a security-conscientious reviewer looks at the code, spots * being a valid return value, remembers that * is the default value in /etc/shadow for "no password login please" and then is all like:

This is fine, you check for * and return + instead.

There are more 32-long character sequences than atoms in the universe. Pick one, any of them instead.