On older versions (perhaps in 0.8.x), the wallet password was required to add a new receiving address.
This is no longer the case on Bitcoin Core 0.9.1.
This was a bug— it asked for the key in those cases but did nothing with it.
Why is this? I find this a bit strange, because shouldn't a password be required to store the new private keys?
No, 100 addresses (by default) are precomputed— this is also what makes your backups stable. If it runs out it will prompt you for the password so it can generate more.