Why might a production Dockerfile explicitly set a non-root USER?

Running as root inside a container means that if an attacker achieves code execution, they have root privileges within that container's namespace, increasing the impact of any container-breakout vulnerability. Switching to a dedicated non-root user limits the blast radius of a compromise.