A lot of attacks don't require root/admin to be effective. Some Key stroke loggers run entirely in user space.

    edit: https://github.com/w8rbt/keycap