I think there is kind of an assumption that the scenario is “outside host gains privileged access” so there’s not really a security issue with some attacker deleting root on their own box.