is not so much replacing the root user folder: you can argue that forcing the root
to have a PAS is a net win: rather, it is Plone's unnecessary shadowing / overriding
of stuff from the root user folder (acl_users for one, error_log for another).

I *know* why they do it ("seamless' experience", or some such excuse) but there is
no good reason to have more than one of either of those two objects in a "normal"
site: "one user folder to rule them all" should be the default.