I haven't seen anyone mention this critical part of the flaw - if you disable the root account, then log out and log back in, the root account is active again.

I haven't seen anyone mention this critical part of the flaw - if you disable the root account, then log out and log back in, the root account is active again. Password change is the only protection until it is patched.