This precise issue came up again recently. Thanks for @philipp2 for reporting it!
If you are invited by email to a Discourse site, you can accept the invitation by clicking the invite link. You are then allowed to set up your account without having to specify a password. Because your email address already known, you can always log in later with a link sent to your email, add a password, or use social login if it’s set up on the site. In this case everything works perfectly as it always has.
With recent changes to the invite system, we now allow the creation of invite links as well, which can then be copied and shared outside Discourse. This adds the need to require email addresses to be confirmed before invitees log in and get access to discussions. I’m not sure why, but in this case if you complete the form without setting a password, you get a different confirmation email that sends you to a link that requires you to set your password before logging in.
The solution here methinks is to have the invite acceptance form always operate just like the regular signup form, which as the OP shows in screenshots requires passwords. We could then remove the functionality that sends an alternate welcome email with password reset instructions and link.