Pulse, permissions and privileged agents

[strangerinusall]

I just recently deployed Pulse (v5) and so far I am extremely happy with everything, thanks for making this nice product!

I did my own research but couldn't figure out this permissions concern of mine. Obviously Pulse is a monitoring tool I would prefer to not give it any write/root permissions if not necessary. Now I am normally logged in as root both to my Proxmox and VMs/LXCs. So I executed the deployment scripts on them using my default root user. Also when I check config at /etc/systemd/system/pulse-agent.service I see User=root.

So I have couple of questions:

1. Is there a better way to run these agents e.g. with a lower priv user? (I only need read-only monitoring)
2. Looking at agent config it says User=root meaning agent is running as root user. Is not a security risk?
3. Hypothetically, let's say this github account of Pulse gets compromised and consider that I deployed my agents as I did now (run script using root user). Would this allow a malicious actor to gain root access to my Proxmox/VMs/LXCs?