Why should containers avoid running as root?

If an attacker exploits a vulnerability in the containerized application, running as root gives them root privileges within the container's namespace, which significantly raises the severity of any subsequent container-escape vulnerability versus the more limited blast radius of a non-root compromise.