alt Hacker NewsWith a user shell, I can grab their browser data, personal documents, and try to set up persistent background daemons that listen on programs and do keylogging/screenshotting (harder on Wayland than it was on X11).
With root, I can read all program memory, try to extract decryption keys for encrypted filesystems, modify the kernel, punch open backdoors, modify any arbitrary program, read all user files, etc.
A notable extra issue is the rise of AI agents, which often eagerly test the boundaries of every sandbox they are placed within. I would not run an AI agent as root, nor would I give it full access to a rootful container runtime.
The kinds of things that you list that an attacker could do with root access don't sound like things that an actual attacker would want if they are infiltrating random people's personal computers for their own gain. Modifying the kernel or arbitrary programs is so far beyond what typical malware tries to do that I think it seems kind of silly to consider those things when evaluating the security of an operating system designed for personal computers.