That's the way Proxmox issues privileges to containers by default. I don't know how bulletproof it is, seems very reasonable.