It is a commonly accepted best security practice to disable remote
root logins on *nix systems including Linux. Thus, in order to log in directly as root, you need to have physical access to a trusted console (in the case of many Linux systems, one listed in
As a consequence of the above, to gain root access remotely, you first need to break into an ordinary user's account, then additionally escalate to root access. In this case, the password on the root account only protects against a password-cracking attack on the root account, not any of the other multitude of possible ways for an attacker to escalate privileges.
Given that the system console should be physically secured anyway (even in most homes it's usually kept behind a locked door when unsupervised; many homes have burglar alarm systems installed; and even workstations in corporate locations are almost always either behind locked doors or in alarmed areas; servers even more so), and that if an attacker has physical access already file system permissions present barely an obstacle, why would the root account need a strong password? Couldn't we use a simple password for the root account more to protect against simple mistakes or casual attackers, than determined attackers?