Should I set up a password for mariadb.sys@localhost?
Here's a great article that explains the purpose of that account.
This section of the article in particular explains why MySQLTuner is complaining:

It uses an invalid password (see the output of SHOW CREATE USER
above). This ensures that should the account get unlocked by mistake,
it is still impossible to login. It is thus recommended not to reset
the password.