If an attacker gets a hold of your app server, they will be able to get the connection details for that DB, including the username/password. Having a password

If an attacker gets a hold of your app server, they will be able to get the connection details for that DB, including the username/password. Having a password adds a small layer of protection to databases that the affected app wasn't meant to connect to. It adds some protection in that case, but the user should use best judgement if it's worth doing.