"State-bloat" attacks led to an empty account being defined as an account that has zero balance, nonce and code.
There was a disagreement on EIP 161:
I disagree. An account should be considered empty when the code, nonce, balance and state root is empty.
Is it possible to have an empty account with a non-empty state root? What is the difference between requiring the state root to be empty or not?