Why on Earth do ordinary systems need CUPS binding to a port at all?

They don't need. Want, for listening to network printers announcing themselves. It's a very bad system, even then.

Have you ever seen a network printer announce itself by talking to a print daemon on port 631?

I’ve seen network printers announce themselves over DNS-SD/mDNS and over NetBIOS, AppleTalk, etc. All of those are a layer beneath the print daemon.

They don't. cups-browsed is a legacy component that isn't needed on ordinary systems, which outsource printer discovery to an mDNS service such as avahi.

It's common practice to open the socket to start listening on the <1024 port, then drop the root privileges and continue as a different user.

On a modern Linux system, it’s better to use the CAP_NET_BIND_SERVICE capability instead. Then you don’t need to start the process as root at all.