Uh-oh, Apple.
After fixing that embarrassing macOS High Sierra bug that let anyone create a root account on a Mac without a root password, Apple introduced a new bug, albeit one far more benign.
The security update 2017-001, described here, indeed fixed...