When a user account has
REQUIRE SUBJECT, it simply places the restriction on connection attempts that the client must present a valid X509 certificate containing the subject
subject. If the client presents a certificate that is valid but has a different subject, the server rejects the connection.
Note that, in the MySQL Documentation, a sample user was created with both:
GRANT ALL PRIVILEGES ON test.* TO 'root'@'localhost'
IDENTIFIED BY 'goodsecret'
REQUIRE SUBJECT '/C=EE/ST=Some-State/L=Tallinn/
O=MySQL demo client certificate/
PCI and HIPAA would shriek "INSECURE" if a root user had no password, SSL or no SSL. This would be the case even more so with a Replication User.
Therefore, what is the practical value? : Having a password would provide another level security.