Let's say somebody sitting under user (non-admin, not root), but he didn't set up any password for it, only superuser/root has password. Is it bad practice (in context of remote access to a desktop through Internet) ?
As you point out the user may not be able to do any permanent damage to the system without admin rights but there is a lot they can do which you'd prefer they didn't.
Zombie machines get used for carrying out DDOS attacks and sending spam or as proxies for carrying out further attacks. It's a particular problem with IoT devices at the moment. Those responsible for these attacks actively search the internet for machines they can login to. You might think that an obscure username is enough but that's generally not true. Attackers will try very very long lists of usernames with blank passwords.
If you have any remote login to the system accessible from the internet (eg SSH or just email SMTP) then this user will be breached. There are countless bots on the internet poking every single internet IPv4 address.
For reference I receive around 500 pokes per day. I've seen reports of others recieving 10,000 or even 100,000
So if you allow passwordless login on anything but a reasonably firewalled laptop with no external access you can pretty much guarantee it will be logged into and used for a further attack.
Yes it is bad practice because using an empty password probably is one of the first attempts of someone trying to hack into a system.
Provided the system is accessible from the outside.
Once an intruder has access to the system they can do whatever the user can do.
This is disturbing enough to take care to prevent that, even if this intruder is "only" running with user's permissions instead of root.