The threat here is if a non-interactive non-root user (e.g. one used for a service like Apache's httpd) is pwned by another means and then this is used to furth

The threat here is if a non-interactive non-root user (e.g. one used for a service like Apache's httpd) is pwned by another means and then this is used to further escalate to root. Otherwise you're right, despite much cargo cult, in practice pwning an user that can interactively run as root, is the same as pwning root.