I don't think that smugly not running as root saves normal users; while malware running as your user can't trash your laptop, they can get your Google cookie and read and send emails as you, spend your money, view your private photos, etc.
How is it getting my root password?
Also, once they get ACE they can modify your bashrc to make sudo an alias for “sudo rm -rf / ;” or all sorts of other evil trickery.