The point is also to minimize potential damages caused by a bug in the software. Just this year there have been multiple data-destroying bugs in publicly released software. If the app runs as a server it’s usually trivial to have it run as a dedicated user, with just enough permissions to do its job.
It’s just good practice, even though the risks might be low why risk it at all?
Yeah, I’m pretty sure 15 minutes after this post OP was crawling barefoot in HVAC ducts.