Using It Safely

It is a real attack surface. It is at a predictable address, it accepts passwords, and behind it is everything.

Use strong passwords for every staff account, keep is_staff and is_superuser to the smallest possible set of people, and consider moving it off /admin/, which at least removes it from automated scanning. Turn on two-factor if the project is anything you would be upset to lose.

Staff is not superuser. is_staff means someone may sign in to the admin at all. is_superuser means every permission, always, regardless of what is ticked.

Giving everyone superuser because permissions are fiddly is extremely common and completely undoes the permission system you already have.