To check if authentication is required for single-user mode:
grep SINGLE /etc/sysconfig/init
The output should be as follows if authentication is required.
SINGLE=/sbin/sulogin
By default, no authentication is performed if single-user mode is selected. To require entry of the root password in single-user mode, add or correct the following line in the file /etc/sysconfig/init.
SINGLE=/sbin/sulogin
Why? I can only guess. Perhaps it is assumed that the machine is physically secure.
As @JeffSchaller points out, the current value of SINGLE is likely /sbin/sushell.
To incorporate a good comment by @BaardKopperud as well, to try to keep it from getting buried in comments...
Well traditionally single-user would mean no network and no remote or terminal log-ins. The only active terminal would be "the console" - the one terminal directly hooked-up to the computer - usually located in a locked computer-room with access to only a select few. In such an enviroment, it probably didn't matter so much if there were no password - especially since it usually would require the root-password to take the system to single-user in the first place.