To answer the question in the title directly:
Wipe everything, reinstall macOS and restore files from backup (not from the infected machine).
For completeness, it's worth mentioning there exist attacks that e.g. infect the firmware of storage devices, necessitating the entire hardware to be destroyed to ensure 100% safety. Unless you have reason to believe you are being personally targeted by a government, though, this isn't a realistic worry - by contrast, infecting any part of the data actually stored on disk is orders of magnitude easier and a very realistic threat. Even if you were just the victim of an automated, untargeted attack, wiping everything is a necessary precaution.
If an attacker has root access, they can, among other things, replace any binary with their own version that can do whatever they like, meaning that you cannot trust anything on your system anymore. Quite literally anything you try to do might end up doing something completely different. If the hacker wanted, they might make
cat return doctored version of files to e.g. hide log entries showing unwanted activity;
ls could fail to show files added by the hacker; any text editor could pretend to save what you write but actually silently ignore your edits, etc., etc.
Can't I at least keep my files? I have things that were backed up a while ago/aren't backed up at all
The reason you don't want to copy your files over is that there are plenty of non-executable file types that can exploit some vulnerability or other and reinfect your system. Compressed archives of various types and PDFs are common carriers, but by no means the only danger. You're probably safe copying over a plaintext, non-executable text file (remember to not use the compromised OS to do that, though), but remember that the attacer could have changed absolutely anything in absolutely any way they wanted,so treat everything like you would treat a random file accidentally downloaded from a shady website.
You also have to think about why the hacker would do something like that. Replacing
ls with malicious versions is entirely possible, but making the output sophisticated enough to fool you into thinking everything's fine is much more complex. If the hacker just wanted to spy on you, they'd install a keylogger and leave everything else alone. If they wanted to use your machine in a botnet, they'd install the necessary software and leave everything else alone. If they wanted your money specifically, they'd have installed ransomware, and you'd know that already.
None of the above cases involve editing your bash history, or changing the hostname of your machine. A keylogger or similar rootkit can be made virtually undetectable. So while a root attacker can do anything, usually that means you'll never be able to guess they're there, except by e.g. observing your load being higher than usual when your compromised machine participated in a botnet. Or if they didn't mind you knowing they were in, it's much, much easier to just lock a user out (e.g. by changing the account password) than mess with the bash history. (Or, again, ransomware.)
So what happened here and what should you do?
The other answers already describe what I personally agree is the most probable scenario: a few flukes, like the DHCP server changing your hostname. In which case you're uncompromised and fine.
The alternative is that someone manually broke into your machine, and is either clumsily trying to hide it, or intentionally messing with you. This could be a family member, or coworker, or other acquiantance; perhaps they might have shoulder-surfed your password. If that the case and you're certain they didn't install any rootkits or keyloggers in the meantime, then just changing the relevant passwords (root, and your user's) should be enough. But you really can't know what they did or didn't do, and once you already have root access it's utterly trivial to install a ready-made malware package - so if you truly believe someone gained unauthorized root access, then, as explained above, wipe everything.