In chapter five of the security handbook, titled "User/Group Limitations", the information regarding "/etc/login.access" is outdated. This file does not exist, and according to bug #442, this file should be referenced to as "/etc/security/access.conf".
Further, it should be noted that "/etc/security/access.conf" settings do indeed apply to root.
Fixed. Thanks for reporting.