Comment by mortenlarsen

> Why is the root password hash even in memory in the first place?

Maybe /etc/shadow is in the filesystem cache.