This is consistent with the rest of qubes-core-agent-passwordless-root, and helps prevent sandbox escapes by daemons with dbus access.
misc