This is not an obscure configuration option. Your password file almost certainly has at least one account with "*" as the password hash.

Integration of different software is the stage most likely to introduce uncaught bugs. That is what happened here: musl intentionally broke the documented API of a function used by OpenSSH. Then Alpine integrated this incorrect implementation with OpenSSH.