Rootsh is available in the Extras... not testing, not devel, not anything. So "gaining" root has not been hidden, or in any way discouraged. It's in the user repository.

For me to take that argument seriously (that users shouldn't have it) - it needs to be permanently in testing. It is already so easy to get rootsh that it makes it pointless that it's not there by default.

I agree with the rest of your comment ColdFusion... Testing and Devel repositories have to be added by hand for a reason - and both come with a warning banner. Neither of these conditions apply to rootsh. It's already point-click easy to get root.. may as well just make it default. OR, if the intent is to protect users from themselves... bury it better. Pick a theory and go with it.. right now it makes no sense.