We've just had a string of very public privesc exploits, and there are plenty of non public ones as well, so running as non-root doesn't necessarily mean much.