It is a setuid binary because it does sudo.

You cannot accomplish sudo without setuid. Note that sudo means gaining privilege in the current context, with all its environment (including inherited file descriptors, the process group, etc.), not doing a privileged action at a distance.

> also true for the /usr/libexec/polkit-agent-helper-1 helper it uses which is a setuid binary but doesn't really have to be

Try making it non-setuid and see what happens.

(It will fail to check your password because most mechanisms for doing so, like the usual pam_unix, are only accessible to root.)