One if my clients got hacked via an insecure application, that was used to get a shell, to then escalate to root via docker. Luckily it was a white hat team we hired.
Is it worth it to go rootless? Depends on your threat model.
For my home setup I don’t bother.
Sad :(