The "BobZAdmin" example is because it's also a compliance issue if administrators don't have separate accounts for administrative actions, but the compliance assessors don't like the privileged accounts to have the substring "admin" in their usernames.
The default username 'admin' hits all three of those compliance complaints.
Setting its password hash to "*" is enough to prevent a user from logging in as 'admin', and doesn't risk breaking other stuff. Specifically, setting the shell to /sbin/nologin causes interactive sessions to fail, so if you log in as an unprivileged user (logging in as UID 0 is yet another compliance issue), you can't elevate to root privileges.
