It would IF they obtained a root shell and started typing commands into it like they were at the console, and that they didn't just go ahead and delete the hist

It would IF they obtained a root shell and started typing commands into it like they were at the console, and that they didn't just go ahead and delete the history file right afterwards. But if someone's used a privilege escalation method on some vulnerable software and injects code that makes system() calls as the root user, that's not going to show up in root's shell history. Shell history is just a convenience for the user typing things in the shell; it doesn't log everything that goes on in the box as that given user, and isn't an audit trail.