> others can remotely & silently access the system as root.

They already can:

https://gfycat.com/gifs/detail/sentimentalnaiveantelopegroun...

Even if you're on a dedicated machine, this vulnerability enables a local user to bypass the authentication prompt on things like System Preferences or other auth checks.

I'm advising folks (incl. non-tech) to set a root password and then re-disable the account (specifically via shell), which prevents this from re-occuring:

https://www.facebook.com/amar.sood/posts/10209545863036116

No, root is root and has always been there. It's the super user account and cannot be removed, I think, from any modern unix like os (well, you can rename it to whatever you want in linux but UID 0 will always be there). The difference might be that if you do log in for the first time you will have lots of stuff on /private/var/root (talking from memory but it was something like that in OSX) and lots of preferences will be set, maybe even a /Users/root folder I hope that the SSH server, which is disabled by default, will also handle root login in a sensible way, but given the size of the f* up, I'm not so sure.

Really bad stuff

> Once you enable root access - by 'testing' this - others can remotely & silently access the system as root.

That's not accurate. The user appears to be there either way, but attempting to log in to a machine remotely using 'root' and no password does not work - even after doing the preference pane thing...