I think OP's point is that, if the attacker already has root, they haven't gained any new capabilities from the CVE. They could just do whatever they wanted much more directly. Therefore, the inherent risk seems fairly low.
Yes if that was an accurate description of the supposed vulnerability then I would agree that it's bogus, but we're filling in a lot of blanks here and something tells me there's more to it than that.