I can vouch for jkl 2 idioms.

I also disable root ssh login, and leave the root account as clean as possible. It's only a last resource maintenance/recovery/single-user-mode account. Most of the things can already be done via sudo/doas/polkit and other good access control policies, so there should be no need to login directly as root.

As far as safeguard goes I have this: