My smartphone has been rooted rather obviously. Ring volume was turned off and didn’t want to be altered. Different statup sequence with options to enter bios and microcode on restart.
A friend’s Debian laptop had the root password changed. Her phone answering device also reporting wrong details of calls e.g. external, international.
The obviousness and lack of finesse involved is striking and I’m unused to it. Undecided whether it’s incompetence or deliberately over the top to be noticed. It’s strange that it’s such a brash approach.