So, I've read that I shouldn't permit root logins by disabling them in my sshd_config. I understand how that might make a server safer, but if I have a user that is allowed to do "su root" and log into the server as root that way, what difference does it make? Seems like having a user that can log into the root user that way kinda defeats the purpose of the "PermitRootLogin" option.
PermitRootLogin No doesn't prevent root logins entirely, it only prevents root logins through ssh. Enabling this option prevents a class of brute force attacks where an attacker tries to
ssh root@server with some common passwords (including an empty password, which can work if
PermitEmptyPasswords is enabled). The point of refusing remote root logins is that
root is a very common username; by disabling remote root logins you require the attacker to also correctly guess a valid username.