For most types of automation they only need to access your filesystem once as well, but accessing the filesystem as root once also implies they can again (albeit at increased risk of detection).

Your second sentence is pure FUD imo.