If stuff isn't running as root, but still running as you, that still gives it access to a fair amount of private data. So, to keep really suspicious code from

If stuff isn't running as root, but still running as you, that still gives it access to a fair amount of private data. So, to keep really suspicious code from reading your banking details, etc., you need to run it under a different uid than the one that runs, say, your web browser.