@lcamtuf another 2 things that seem to prevent this are:

1. setting actual passwords on accounts with real shells
2. disabling ssh based password auth.

I have always done both on all of my systems, so I was relieved to find out that I'm unaffected this morning. Systems updated.