In addition to tedunagnst, as we're talking malware, consider also "kernel exploits". Even if the malware doesn't ship with an exploit, a normal UNIX user has enough privs to examine the kernel version and download and execute code that may exploit the given kernel.
That's slightly less interesting. If you gain root then there's not much to it for dumping packets or hiding processes and open files and sockets or anything, really. Why would the article highlight "intercept network packets as a non-root user" of all things (paraphrased)
