That was explicitly mentioned in the article, as was disabling password-based logins entirely.
Say ssh disallows password login but I know the root password, if I ssh on to the box as another user I can then su to the root user. If the root user does is locked I can't do this.