You obviously know the answer now: yes. However, it is even easier than it seems. As a root user you can actually reset the root password for a MySQL installation. I've had to do this before: I had a brand new installation and I forgot to record the MySQL root password. It took less than 5 minutes to reset the root password in MySQL, and I had full access to the MySQL database after doing so - it made no changes to anything in MySQL at all (other than the root password).
Of course even that might not matter. If your database server and application server are one machine then a smart attacker can just look at your application, see how it is authenticating (typically as simple as reading credentials out of source code or an environment configuration), and login like that.
It would be very difficult to come up with a way to lock the root user out of MySQL, and if you managed to do it you would probably be more likely to hurt yourself than a malicious user. In general if an unauthorized user gains root access to your server, you're pretty much hosed.