Does it ever make sense for a server to provide a 200 response when a GET request is made for a non-existent file?
In my opinion any URL that fails to complete its operation (ie the resulting file is invalid or not returned) should really return a 5XX error. The spec implies a response should always be sent with a 200 response:
200 OK - The request has succeeded. The information returned...
This is further implied by the existence of the 204 response which is specifically for requests that dont return a response:
204 No Content
The server has fulfilled the request but does not need to return an entity-body
Does the described behaviour make sense? No.
Shouldn't the response always be a 404?
404 seems like a good choice to me...
The server has not found anything matching the Request-URI. No indication is given of whether the condition is temporary or permanent.
...
This status code is commonly used when the server does not wish to reveal exactly why the request has been refused, or when no other response is applicable.
Though if the script returned a 404 i would still expect a JSON encoded response the size of the content length header.
Bare in mind "should you" and "will it work" are 2 different questions. So long as the consumer of a website/service understands the meaning of a 0 byte response its perfectly legal. You can set the response code to any number between 1 and 999, you can invent new headers etc - but most clients wouldnt know what to do with those responses. The Mismatch between content length and content received will likely cause requests to hang until the connection times out or is explicitly closed.
not my server/code and the definitely does not exist on server
The described behaviour seems like some active script is intercepting the URL and quietly failing to load data based on it from somewhere (filesystem, database etc). This is a common pattern for controlling access, analytics, caching etc.
Essentially i think the server is sending the response headers before actually checking the data exists. This would result in a 200 response, without returning any data. In short, this smells like a bug/bad practise.
See HTTP spec