Is a website really non-conforming though if on a simple username/password login form you do not state that all fields are required?
You should be ok if the username/password fields don't require any special instructions. If the username was something unusual, like a phone number or membership number, then you'd probably want instructions associated with the input field (via
aria-describedby). But for standard username/password fields, you're ok.
The intent of 3.2.2 is "so that users know what input data is expected". For username/password, it's well known what is expected. If you had more input fields than just those two, then you should mark the fields as required.