The workflow to set a password on an account which does not have one is:

• Log out.
• Use the "Reset Password" workflow to get a password reset email.
• Use that to set a password.

It's intentional that this flow is a little more involved than just typing a password.

One attack that "just type a password" allows is that an attacker can wait for you to get up without locking your terminal, then quickly add a password to your account and log in from elsewhere. This can be fast and hard to detect.

Forcing you through a reset + email workflow isn't much better (since you're probably logged in to Gmail or whatever too, in a different window on the same machine), but does make this attack at least marginally more difficult to execute without alerting the account owner (it will take longer, they may see the email on their phone before you can destroy it, etc).

When setting a password for the first time like this, we should probably also MFA you if we don't already. That should make the attack a bit more difficult.