I think on a server the "don't login as root" recommendation isn't as hard. If you are on a desktop, you don't use root privileges most time. But if you are on a server, most time you use it is some maintenance task. While you can give people who only have to care for the webserver limited accounts, if you are the admin of the server, you can give yourself root login. Bruteforcing is hard if you use a key for root login.

I think on a server the "don't login as root" recommendation isn't as hard. If you are on a desktop, you don't use root privileges most time. But if you are on a server, most time you use it is some maintenance task. While you can give people who only have to care for the webserver limited accounts, if you are the admin of the server, you can give yourself root login. Bruteforcing is hard if you use a key for root login.

If you give some people ALL=(ALL:ALL) ALL-sudo rights, you should do the logging on another server, as some of their commands might tamper with the logs.