> ssh needs a capability to let root logins

One can disable root login via SSH in /etc/ssh/sshd_config. sshd also drops root priviledges once it's running IIRC.

I use use sudo or doas as a regular user once logged in.