The point is limiting your losses. If someone should happen to
break into upsd
in that environment, they should only gain access
to that one user account. Direct access to the serial device is
not possible, since that is owned by another user.
There is also the possibility of running the drivers and upsd
in a
chroot jail. See the chroot
option in security.txt, upsd
and driver documentation.
Why give would-be vandals any sort of help?
Put it this way — I wrote good chunks of this stuff, and I still run the programs this way locally. You should definitely consider using this technique.