I don't do much admin outside my hobby boxes. One guess would be, excluding the ability to enter a root shell, each sudo command is logged so you know who ran

I don't do much admin outside my hobby boxes. One guess would be, excluding the ability to enter a root shell, each sudo command is logged so you know who ran it. If the user is root, then it's harder to know what they did while they were root. Disabling root also means you now have to guess the username and the password instead of just the password.