Since "root" in an SELinux configuration has just that one job, it is significantly easier to limit access to that privilege level to very specific cases which

Since "root" in an SELinux configuration has just that one job, it is significantly easier to limit access to that privilege level to very specific cases which you can two-man or externally record ala the script command. Assuming, that is, the system was set up that way in the first place. Which is such a PITA that I totally believe they just skipped it.