That might not be enough. There's a tweet claiming it isn't limited to the root account, and applies to other similar Apple-default accounts on the system, such as the _applepay user account:

https://twitter.com/unsynchronized/status/935656609140711426

That seems to match the technical explanation of the bug here:

https://objective-see.com/blog/blog_0x24.html

The tweet claims they've got Apple Remote Desktop access & screen sharing working via the _applepay user account. Why/how that's possible, I have no idea - I don't have High Sierra to confirm this, and I'm not sure I'd want to mess with the _applepay user account even if I did.