I do have a password. Sudo is just setup not to ask for it.
On servers of course I use a password for sudo - but on a home machine there’s not much of a point I don’t think. It’s off when I’m not actively using it, and if some attacker or malware has access to my user they already have access to all my important files, or have physical access.