if you use that CA to issue a leaf certificate for your server then you don't need the root CA's password or decrypted private key to be in memory all the time,

if you use that CA to issue a leaf certificate for your server then you don't need the root CA's password or decrypted private key to be in memory all the time, but then of course you make generating self-signed certs more complicate (generate self-signed root CA protected with password, and use that to issue a passworddless leaf certificate).