FWIW:

1. That wasn't a bug for "over a decade," as far as I'm aware. It was only introduced with an OS update

2. I could be wrong here, but it required you to already have created a root user with a blank password, which isn't possible unless you know how to trigger another bug that does it.