Arch Linux

systemd v257 supports and recommends fully locked system accounts[1][2][3]:

> systemd-sysusers is now able to create fully locked user
> accounts. For compatibility it so far created accounts with a locked
> (i.e. invalid) password, but not marked locked as a whole. With the
> new "!" modifier for "u" lines, it is now possible to create fully
> locked accounts. The distinction between accounts with a locked
> password and fully locked accounts is relevant when considering
> non-password forms of authentication, i.e. SSH and such. It is
> strongly recommended to make use of this new feature for almost all
> system accounts, since they usually do not require (and should not
> permit) interactive logins. All of systemd's own system users have
> been changed to be marked as fully locked.

Package list generated with: pacman -Fl | grep " usr/lib/sysusers.d/$" | awk '{print $1}'

[1] https://github.com/systemd/systemd/blob/25a306f6c4d9b8596e25d7771802f005ebae91ba/NEWS#L822-L832
[2] https://mastodon.social/@pid_eins/113395418561365864
[3] https://www.freedesktop.org/software/systemd/man/latest/sysusers.d.html#u