I don't think that smugly not running as root saves normal users; while malware running as your user can't trash your laptop, they can get your Google cookie and read and send emails as you, spend your money, view your private photos, etc.

I mean, there are... not-totally-unreasonable workflows that do clones as root.

Edit: although I am struggling to think of one that clones from an untrusted source.