This is really about as bad as it gets. No password required to access your laptop as the most privileged user on a Mac: root. https://www.macrumors.com/2017/11/28/macos-high-sierra-bug-admin-access/ It's fixable, but you need to fix it as soon as Apple releases the patch for it. Hopefully, that'll be by Friday, 1 Dec 17. This latest disaster is not a one-off for Apple. They've been doing idiotic things like this for years.