So are you allowing authentication-less access to root account?
With SSH protocol, WinSCP prompts for password only if the server asks for it. So that would imply that authentication-less access is not allowed.

For I tried see if I can automate login with hostkey

Maybe you wanted to automate login with private key actually. But you haven't specified any with the "open" command

For I tried see if I can automate login with hostkey, however the password is empty for the user(so I use username:), it always give me the prompt for password.

What is the right way to do it? so it will not prompt me if the password is empty.

Here is my example:
C:\winscp437>winscp /command "open "sftp://root:@16.107.169.183" -hostkey
=""ssh-dss 1024 71:f7:da:9e:09:f7:b5:49:67:eb:c9:13:90:ef:b5:b4"""
Searching for host...
Connecting to host...
Authenticating...
Using username "super.super".
Using keyboard-interactive authentication.
Password: <----enter it stop right here, prompt for password, and I have to hit an enter key to by pass this point and then it will continue.

Authenticated.
Starting the session...
Reading remote directory...
Session started.
Active session: [1] root@16.107.169.183
winscp>


Of course, if I specify a username and password on another system..that will work fine.

C:\winscp437>winscp.com /command "open "sftp://root:mypassword@blosm2-clim3.cacla
b.cac.corp.net" -hostkey=""ssh-rsa 2048 f7:bb:6a:16:04:af:ca:ba:c9:c1:36:9b:a
d:0a:c4:36"""
Searching for host...
Connecting to host...
Authenticating...
Using username "root".
Authenticating with pre-entered password.
Authenticated.
Starting the session...
Reading remote directory...
Session started.
Active session: [1] root@blosm2-clim3.caclab.cac.corp.net
winscp>