Not all package managers require root.

But yeah, maybe through an exploit with a narrow reach. Once in, the malware can veto security updates and escalate to full control.

With root, malware can reach out to UEFI anyway, and can do whatever it likes.