I can't imagine that root is any faster. It's just a lot easier to run things as root vs splitting out separate processes with their own isolation mechanisms.

That the service runs as root isn't really the issue here. None of the attack relies on the abuse of some root capabilities, it's an authentication issue that abuses how the service works. Even if it were unprivileged somehow, this would still be the same impact.