Right now I just disabled the password completely but was looking into the same topic for remote deployment. In my research stumbled upon this post but I haven’t had the time to test it though.
My guess is that you are not directly executing the specified command but rather using the symlink in current system which does not fit the rule above. But that is just a guess 