I regularly remote into in order to manage, usually logged into KDE Plasma as root. Usually they just have several command line windows and a file manager open (I personally just find it more convenient to use the command line from a remote desktop instead of directly SSH-ing into the system)

I'm not going to judge you (too much), it's your system, but that's unnecessarily risky setup. You should never need to logon to root desktop like that, even for convenience reasons.

I hope this is done over VPN and that you have 2FA configured on the VPN endpoint? Please don't tell me it's just portforward directly to a VNC running on the servers or something similar because then you have bigger problems than just random 'oops'.

I do also remember using the browser in my main server to figure out how to set up the PiHole

To be honest, you're most probably OK - malicious ad campaigns are normally not running 24/7 globally. Chances of you randomly tumbling into a malicious drive-by exploit are quite small (normally they redirect you to install fake addons/updates etc), but of course its hard to tell because you don't remember what sites you visited. Since most of this has gone through PiHole filters, I'd say there's even smaller chance to get insta-pwned.

But have a look at browser history on the affected root accounts, the sites along with timestamps should be there. You can also examine your system logs and correlate events to your browser history, look for weird login events or anything that doesn't look like "normal usage". You can set up some network monitoring stuff (like SecurityOnion) on your routers SPAN, if you're really paranoid and try to see if there's any anomalous connections when you're not using the system. You could also consider setting up ClamAV and doing a scan.

You're probably OK and that's just paranoia.

But... having mentioned paranoia... now you'll always have that nagging lack of trust in your system that won't go away. I can't speak to how you deal with that, because it's all about your own risk appetite and threat model.

Since these are home systems the potential monetary damage from downtime and re-install isn't huge, so personally I'd just take the hit and wipe/reinstall. I'd learn from my mistakes and build it all up again with better routines and hygiene. But that's what I'd do. You might choose to do something else and that might be OK too.

Yes. Running anything as root is potentially dangerous. And a browser is a complex and big piece of software with many security issues that can be (potentially) triggered remotely. So it's bad because of two reasons.

Btw a desktop environment also is a complex and big piece of software with potential issues. Running the whole desktop as root is another thing you wouldn't do for extra security.

The proper way is to just create a user account and run the desktop and browser as a user. Open a terminal and 'su' or 'sudo' to limit root rights to the operations that actually need those permissions.

Just running everything as root certainly works. But you do away with all the extra layers of security and end up with something as secure as MS-DOS or a Windows in the 90s or early 2000s.

No if you leave it running and don’t use it.

It should be ok because nothing will run on your system without a permission prompt at least. So they that should ring some bells of system is asking for your password when you didn't try to install anything.

But best practice would be log in as a regular user and use sudo to do any admin tasks.