From openssh 7.0 release notes:

  * PermitRootLogin=without-password/prohibit-password now bans all
    interactive authentication methods, allowing only public-key,
    hostbased and GSSAPI authentication (previously it permitted
    keyboard-interactive and password-less authentication if those
    were enabled).

It mentions that previously without-password it would still allow keyboard-interactive logins. Should be fairly easy to fake for a botnet!

I still prefer "PermitRootLogin=no".

However unrealistic it is, I still wish that open source Projects would agree on what to call things.

The /etc/sudoers NOPASSWD and sshd without-password sound like the same thing, but are far from that.

I feel like they could have named it better.

Sudoers NOPASSWD means you don't have to type the password for that feature. Sshd without-password means passwords are disabled. Not the same thing.