With commit de911c73504da8 (version 1:7.4p1-1), setting openssh-server/permit-root-login to false results in "PermitRootLogin yes". So this issue can be closed.