Will 'nullok' option allow users to login without entering a password?

Issue

I have a nullok entry in /etc/pam.d/system-auth file:

$ more /etc/pam.d/system-auth |grep nullok
auth        sufficient    pam_unix.so nullok try_first_pass
password    sufficient    pam_unix.so md5 remember=6 shadow nullok try_first_pass use_authtok

If an enabled account on the system is not password protected, then the users can login with no password. How do I fix this issue?