This KB page, https://mariadb.com/kb/en/library/mysqluser-table/, says that if plugin column is empty, default authentication plugin is used: "If empty, use the default."

But it says nothing on what this plugin is and what it depends on. Compare to https://dev.mysql.com/doc/refman/5.6/en/grant-tables.html that presents a lot of details:

"If the plugin column for an account row is empty, the server authenticates the account using the mysql_native_password or mysql_old_password plugin implicitly, depending on the format of the password hash in the Password column. If the Password value is empty or a 4.1 password hash (41 characters), the server uses mysql_native_password. If the password value is a pre-4.1 password hash (16 characters), the server uses mysql_old_password."