An early hack in Unix was to make a symbolic link to a setuid shell script and call the link
-i. This results in the script being called as
sh -i which instead of executing the script called
-i as intended launches an interactive shell, which then gives full powers. Effective user ID can be used to modify the
passwd file for any user or root itself. The best way to guard against this is to use SELinux to prevent trust scripts or programs from modifying outside the area SELinux allows them to run.
Another technique is to have an immutable bit on important files which one set cannot be modified even by the root user (apart from in single-user mode)
As root you can invite users to log on to your system without a password and appear as any user but normal privileged processes try very hard to prevent this from happening.
If you use network filing systems of some sort the root user will be treated as nobody in that file space instead of root which allows untrusted computers to join a trusted network such as a university campus.