Provisioning a new host is not using the root_pass set in Administer -> Settings if an empty string is set as password either on the host itself or in a hostgroup.

The default password should be used even if the root password is an empty string as you can not reset it to NULL in the web-ui.