With a user shell, I can grab their browser data, personal documents, and try to set up persistent background daemons that listen on programs and do keylogging/screenshotting (harder on Wayland than it was on X11).

With root, I can read all program memory, try to extract decryption keys for encrypted filesystems, modify the kernel, punch open backdoors, modify any arbitrary program, read all user files, etc.

A notable extra issue is the rise of AI agents, which often eagerly test the boundaries of every sandbox they are placed within. I would not run an AI agent as root, nor would I give it full access to a rootful container runtime.