Certain programs refuse to run as root. Programs that don't need security tokens are set to run as nobody, or somehow dump their tokens before doing anything else. Program installation tracking systems. Track files created by a make operation, save copies of any files modified that aren't part of the package being installed. The point of all this is so anything done can be undone without manually removing directories and restoring from backup.
Users can install and uninstall programs for their own use.
The archive extractor complains if files are being extracted to the current directory or someplace above it. No need for frequent updates. A recent ZD article's Debian-using author gloats about downloading 40 megabytes of updates a week as if this were a good thing, when the good thing is that he's not on a European dialup. I shouldn't need to download updates right after installing out of the box for at least a month.