Running as a privileged user protects other users and the OS, not you. If code runs as you, it has access to your data, your cookies, your cache, etc.
You don't need to compromise root/a privileged user in order to get the keys to the kingdom. Once I've compromised whatever user your browser environment runs as, mission accomplished.