I've always wondered why they allowed root + password login via ssh as a default all these years. It's like the first thing you disable upon login in...