Windows 98 was not intended to offer meaningful local security. The password prompt was used to collect the username/password to use to connect to network resources. (And also, perhaps confusingly, the password prompt was overloaded to select the local user profile, if such feature was enabled - but entering a new username would create a new account, so being a barrier to using the computer was never the point.)