Even if you allow passwordless su for users in the wheel group?

That's extremely dangerous. Any software running as a wheel user can escalate privileges willy nilly.

they can also access your ssh private keys

In theory, those ssh private keys are password protected.

In practice, maybe not.

They were stored in the user’s yubikeys (or similar) in this example.

If you do that you deserve what you get

Do what!?

We've got root passwords set on, IIRC, all of our systems. They're long, random, and can only be entered through the console on the VGA port or the IPMI console.