Comment by jovial_cavalier

Yes, lots of little web services and such run as unprivileged users, not root. I personally run a bunch of stuff as very restricted users in containers, with the threat model being that e.g. an RCE exploit in one of them will only affect the service, not the broader system.