root is the device that the kernel sees as the location of /. The bootloader can use a different root device, the bootloader uses it to read the kernel and the initial ramdisk into memory.
init is the first (and only) user space program started by the kernel, and this has the task to manage user space (i.e. everything else than kernel space). Normally you would use either SystemV init or SystemD systemd, because they will handle the startup of dæmons, the mounting of filesystem etc. If you use
/bin/bash (anything else works as well), this program gets executed after the kernel has initialized itself, and of course has full access to every device on the computer (i.e. root access). This is not a feature for system administrators, this possibility derives from the open design of the boot process.
Yes, because authentication is not handled by the kernel, this has to be done by a user space process, normally by one started by
init. To do this,
init needs root access...
As the other poster pointed out, if you have hardware access, authentication handled by the operating system (and not based on strong encryption) is futile. For example, you can boot a computer with a live system (on CD), mount the file systems and just
chroot yourself in. With full root access... Encryption is the way to go!