Any user password can be logged in with the SYSDBA role

This is because operating system authentication is used by default when you install Oracle:



After you install the following method, you can restrict sysdba to log on without a password.

Sqlnet.authentication_services= (NTS), in $oracle_home\network\admin\sqlnet.ora
NTS refers specifically to Windows systems or to all, both of which allow the operating system to authenticate.
If you do not set sqlnet.authentication_services under UNIX, the default is operating system certification! or set to all also allows the operating system to authenticate. Parameter sqlnet.authentication_services= (none,nts) indicates which authentication method is used when a user connects to an Oracle server
None represents Oracle database authentication, and NTS represents operating system authentication, which can be used in two ways.



Sqlnet. authentication_services= None

Any user password can be logged in with the SYSDBA role