Same reason people give postgres, php, or any other program a user account.

Why should it be? We have containers and capabilities…

Containers are often used with user namespaces, which is literally another (set of) user account(s).

	▲	khalic 6 hours ago \| parent [-]
		Yes but the encompassing service has the account, not the agent. You can completely segregate it from the rest of the system, like you’d treat an intruder