Oldschool telnetd didn’t actually run as root; rather, it just set up a PTY for the incoming socket to talk to, and then fork-exec’ed a /bin/login subprocess to live inside that pty. /bin/login is setuid-root, so it’s “where the security lived.”

I think we all collectively decided that that was a bad idea at some point — probably because /bin/login was never designed under the assumption that it would have to deal with arbitrary binary network traffic being thrown at it (it really only expects keyboard input.) So we switched to doing auth directly in our network daemons, since at least then “people who are aware the code is network-facing” would be maintaining it.

What do you think proper architecture would be, given that ssh needs a capability to let root logins?

I suppose it could be via a proper PAM module, which is widely supported.

Too bad the first PAM RFC was published about the same time the first be version of ssh was released.

Literally how else is a remote login daemon supposed to work though?