If an app logs in as root and someone finds an SQL injection bug in it, they own every database on the server. With least privilege, the app's account can do its job and nothing more, so the same bug does far less damage.