certbot copies the file to be served as part of the challenge. It can optionally can modify your nginx config to use the cert once its obtained. I don't see why it needs root to do this, but you'd at least need permissions for it to read/write to the appropriate nginx & server folders.