The full access to the docker socket from a user account is typically used on a development machine where malware has many other opportunities to become a root.