Keep your Mac locked.
 

Update soon no doubt.

You can do this if you like. Remember to disable it after the update
https://support.apple.com/en-us/HT204012

Can't you just open a console and change the root password?

/edit never mind.

A similar thing exists on Windows PC's (Windows 10 home) too (although not published).

If you start the PC in recovery mode and open a dos box, you can enable the Administrator account and then login as admin.

It's really bad, mitigated by as you say it being nothing new, you used to be able to pull the exact same trick in OSX recovery console... but Apple were supposed to have secured that. I know when I was a young delinquent I'd have been causing trouble right now.

Update is out, not bad for a zero day, shame it was disclosed the way it was, the bounty would have been nice.

No restart required either, nice.