My sense was this backdoor gets to execute whatever it wants using whatever "user" sshd is running as. So even if root logins are disabled, this backdoor doesn't care.

not only that, but logins show up in logs.

Plus, detection is likely to be be very different.