From what I can tell there is no password for root given by default, and it's considered a bad idea to set one.
But then what stops me or any other user from doing sudo passwd root or something like this, and giving the root account a password?
Sudo only requires our own passwords, so in theory there's nothing stopping anyone from doing this?
This is sort of a broad topic.
At the end of the day, nothing prevents you or another user from setting a root password.
This can happen via several mechanisms including sudo, various exploits (when you read a security alert that allows a user to run "arbitrary code" they can run any command they want), escalation of privileges or other cracking methods, and physical access either booting to rescue mode or with a live usb/cd or other techniques.
Solving or preventing this is a potentially long discussion.
Regular users cannot successfully run sudo passwd root or whatever other commands they choose with sudo. Only administrators can do this. Membership in the sudo group confers the ability to perform any action at all as root with sudo as well as with Polkit, which is a separate mechanism that doesn't involve sudo. Don't give this power to people who you don't trust to have it.
This is to say that not having been given the power to run commands as root is what stops people from performing administrative tasks without authorization, including from setting a root password. People you have given the power to administer the system can set a root password. If you trust those people, tell them not to set a root password (and don't set one yourself) if you don't want one set. If you don't trust them, then the problem is not that they might set a root password, but that they already have the power to do whatever they want to your system!
To be clear, trust is not binary. You can trust people with some powers and not others, and this is even reflected in the security model, where users can use the system but do not have all possible capabilities. But people who can run any command as root with sudo do have all possible capabilities when they choose to. This is why, when novice users ask about setting a password for the root account so they can log in as root, we urge them to consider not doing so. Doing so does not confer any power to the user that the user did not already have. It's not that we want to keep them from obtaining power. They already have that power.
There are risks associated with setting a password for the root user and thus enabling root logins, and benefits of avoiding it. I recommend you avoid this unless you have a clear reason to do so. (Note, however, that there are circumstances where it is reasonable to do so, as well as well-designed operating systems--like OpenBSD and Fedora--where root logins are enabled by default.) But enabling it is not destructive in itself. In contrast, you and any other users you allow to administer the system can already undertake extremely destructive actions by running commmands with sudo, whether or not the root account has a password set.
You are a member of the sudo group. You can delete all the files on the system. You can write raw data to the hard disk, overwriting what is there irrecoverably. You can access other users' files, even if they have set restrictive permissions. You can install new firmware to your physical devices. You can dump users' passwords from the shadow database and attempt to crack them, or just reset them. You can install malware that infringes users' privacy or destroys data, including keyloggers and ransomware. You can do some really weird stuff with your network interfaces. You can make the system misinform users about the security of their communications. You can cover your tracks. You can hand all these powers, and others I haven't listed, over to people who will use them for evil. When it comes to misusing sudo or Polkit, those are the kinds of things you should be concerned about.
It is true that you shouldn't let untrusted people into your house unsupervised, but the reason why is not that they could then unlock the door from the inside and get in.*
It's not setting a root password that's a bad idea, it's logging in or running as root without the built-in protections that sudo provides (requiring reentering your password every few minutes, the requirement to prepend sudo on each command, etc.) which serve as a reminder of the power of an error. If you instead have a root password set, and use su to start a root shell (or, equivalently, log into the GUI as root), you're setting yourself up to reinstall and possibly destroy any stored data on the machine, just because you forget you've given yourself absolute authority.
Ubuntu made the choice to, by default, not allow root login, specifically to avoid making it too easy to screw yourself. Setting the root password encourages you to login and run as root, which is why it isn't recommended to do so.
