This explanation was contained in the description of security.initialRootPassword but got lost when it was deprecated a long ago (f496c3cb) and removed.