You/OP obviously already knew what most here would say, seeing as how you stated
"long story" when you mentioned the null password.
On paper there are various security methodologies/practices, etc. that are very valid.
In reality, it is up to you and your organization to decide what security practices you will follow (or which ones are required by law if you are subject to regulations, etc.).
If you and your company feel that the current setup is ok, then it is. People might say "That's so stupid!" and their opinion is just as valid as you saying "this is what we've chosen to do". It's not any different than painting your house zebra stripes. Most will ridicule and shake their heads, but in the end it is your call.
As others have mentioned, there are ways to query a remote computer, dependent on the tools/rights/skills of the person trying to figure this out.