If you're not going to use rootless containers, then you simply cannot ship the rootful solution as default in a desktop operating system.

There's absolutely meat on the bones regarding root/rootlessness, but that's not the problem at-hand. The problem is shipping vulnerable defaults, and the case is closed.