These days, root is mostly flagged via indirect indicators rather than detecting the root binary itself. For instance, detecting custom ROMs is a common clue. Does anyone remember the suhide days? ;)