New root user I did not create-hacked?

There are all kinds of accounts created and used by the Mac OS and the underlying Unix system. I don't know why the instructions in your link bothered with the sudo command. All that was needed was the list command to see all user accounts.

Here's the list from mine. As long as it is, it's all normal stuff. It also includes the same two you mention. The one line of asterisks is me anonymizing my own account name.

_amavisd

_analyticsd

_appleevents

_applepay

_appowner

_appserver

_appstore

_ard

_assetcache

_astris

_atsserver

_avbdeviced

_calendar

_captiveagent

_ces

_clamav

_cmiodalassistants

_coreaudiod

_coremediaiod

_ctkd

_cvmsroot

_cvs

_cyrus

_datadetectors

_devdocs

_devicemgr

_displaypolicyd

_distnote

_dovecot

_dovenull

_dpaudio

_eppc

_findmydevice

_fpsd

_ftp

_gamecontrollerd

_geod

_hidd

_iconservices

_installassistant

_installer

_jabber

_kadmin_admin

_kadmin_changepw

_krb_anonymous

_krb_changepw

_krb_kadmin

_krb_kerberos

_krb_krbtgt

_krbfast

_krbtgt

_launchservicesd

_lda

_locationd

_lp

_mailman

_mbsetupuser

_mcxalr

_mdnsresponder

_mobileasset

_mysql

_netbios

_netstatistics

_networkd

_nsurlsessiond

_nsurlstoraged

_ondemand

_postfix

_postgres

_qtss

_sandbox

_screensaver

_scsd

_securityagent

_serialnumberd

_softwareupdate

_spotlight

_sshd

_svn

_taskgated

_teamsserver

_timed

_timezone

_tokend

_trustevaluationagent

_unknown

_update_sharing

_usbmuxd

_uucp

_warmd

_webauthserver

_windowserver

_www

_wwwproxy

_xserverdocs

daemon

Guest

**************

nobody

root

Then you may not have been hacked. Try doing a software check using the below to look for unusual software.

Try running this program in your normal user account, then copy and paste the output in a reply. The program was created by etresoft, a frequent contributor. Please use copy and paste as screen shots can be hard to read. On the screen with Options, please open Options and check the bottom 2 boxes before running. Click “Share Report” button in the toolbar, select “Copy Report” and then paste into a reply. This will show what is running on your computer. No personal information is shown.

Etrecheck – System Information

Any thoughts on why a new root user account would've been created over night?

If you mean the account named "root", it wasn't created overnight. It's always been there and is part of Unix.

What was the result of step 7?

Guest is a normal account.

Guest is created if you have "find my mac" activated. The account allows icloud to perform the remote functions of "Find my mac"