@seph if you do

sudo dscl . -read /Users/root accountPolicyData

you can actually see when the root password was last set. That to me would be good enough. (you’d assume that it was not set any time recently if your org didn’t have a policy about that, and then you could see machines where it was set recently when you updated them).