It’s more that SSH and VNC are separate things, and their password requirements are not related to each other. You’re using SSH as the network transport, so you’re authenticating on SSH (password or key, it doesn’t matter).
Then you’re hitting the VNC service, which has its own authentication scheme. VNC doesn’t know how you connected to the box, and it doesn’t know what user accounts you want to use (I’ve never used VNC on Linux; I assume it’s connecting to the current desktop).