MariaDB accepts any password

The answer: https://www.percona.com/blog/2016/03/16/change-user-password-in-mysql-5-7-with-plugin-auth_socket/:

Apparently the mysql-server installation on 16.04 (or any 5.7 installation?) allows root access not through password, but through the auth_socket plugin. Running sudo mysql -u root (n.b. w/o a password) will give you mysql console whereas running the command as non-root prompts you for a password.

It would seem that changing the password doesn't make much of a difference since the auth backend doesn't even check for a password.

To disable this auth_socket plugin, on the mysql prompt do

update mysql.user set plugin=null where user='root';
flush privileges;

This makes MariaDB also ask a password for [Linux] root.

Thanks jesse-b and derobert for the in-depth discussion and your answers.