Is it possible that a phone password was activated without a lock screen?

Someone I know with an Samsung S23 gave someone their phone at a store to help them log in to the store’s app and subsequently they had a fingerprint Lock Screen turned on on their phone that they didn’t want (yes I know not having a secured Lock Screen is a bad idea but it’s not my phone). They wanted to turn it off but it was asking for a password they didn’t know or remember setting. What is unclear to both of us is whether this password would have been created today or if it could have been set up when the phone was first set up. I am not personally an Android user so I have no idea how it works. When you set up a (Samsung) Android phone is it even possible to set a lock screen password without having a protected lock screen activated? Plus, if it does retain a lock screen password like that, if you then activated a lock screen protection wouldn't it ask you first to confirm that password? e.g. on iPhones if you turn off your device passcode you would have to set a new passcode if you wanted to re-enable it / biometric unlocking.