Yup, I completely missed the "fixture is not grounded" violation!

I'll accept that it's a "damp" location. I'd still want a weathertight box.

As to surface mounting that fixture to siding or timber: It's OK for the entire back of the "junction box" formed by the fixture base to be combustible? I mean, I'm sure it's done a thousand times a day, but is it a "correct" wiring method?

I have a theory: The installer intended to mount the light fixture on the box, but after he got it mounted and the conduit and Romex attached, he noticed that the screw holes were on the wrong diagonal (look at the fixture base). Instead of re-doing the box, he just screwed the fixture to the soffit, put a blank cover on the box, and said, "Yeah, I meant to do it that way."