Well root is the default full access account. It is a bit easier to root@serveraddress and brute force in that way than needing to guess which account in the system has sudo access.

It also becomes easier to detect when someone is attempting to break in when you can see logs of common user names in a row fail to log in.

I don't do much admin outside my hobby boxes. One guess would be, excluding the ability to enter a root shell, each sudo command is logged so you know who ran it. If the user is root, then it's harder to know what they did while they were root.

Disabling root also means you now have to guess the username and the password instead of just the password.