Deleting User Picture changes the password of user?
Yes it does. This works as designed, but you made mistake. When you obtain user object, it does not contain a password. It contains a password field, but it's not populated with actual password as it is impossible by design to know it. So you are feeding all fields to user_save, including field for password, but without password in it.