To prevent unintended security holes by not setting username or password for created system users while deploying a module should fail at startup when username or password configuration is missing. For GDPR security by default is required. 

So every module should set up: 

• system user name on a configuration variable. A default fallback value might be set.

• system user password on a configuration variable. NO default fallback value should be set.

e.g.