Something creates /etc/ssh/sshd_config.d/60-cloudimg-settings.conf
which ends up included by /etc/ssh/sshd_config at the beginning.
The file contains a single line that disable password login (and it
can't be overruled by a later entry...)

There probably is a more elegant way of doing this (like preventing the
file from being created).