That’s because Debian has a MySQL account debian-sys-maint used for switching on/off and checking status. The password for that user should be the same as stored in /etc/mysql/debian.cnf. The file looks like this:
# Automatically generated for Debian scripts. DO NOT TOUCH!
[client]
host = localhost
user = debian-sys-maint
password = <password>
socket = /var/run/mysqld/mysqld.sock
[mysql_upgrade]
host = localhost
user = debian-sys-maint
password = <password>
socket = /var/run/mysqld/mysqld.sock
basedir = /usr
If the password doesn’t match (for example because you changed it manually) the init script won’t work anymore. You should set the password according to the file. So
mysql -u root -p
# Then type MySQL root password
GRANT ALL PRIVILEGES ON *.* TO 'debian-sys-maint'@'localhost' IDENTIFIED BY '<password>';