There is nothing to stop someone changing how the OS is packaged to add more users and run apps/services under different creds, but the OS was originally and intentionally designed to keep things super-simple and running under a single user is part of that. The UX design goal is to achieve 99% of tasks in the GUI and thus negate any need to go near the console (which is default disabled) and the fact the entire core of the OS is read-only largely prevents users from causing problems with errant commands. Users can rm -rf their Kodi config but in most cases a simple reboot will regenerate anything essential so the main risk is losing personal media; and users accessing their own media under their own share don't need sudo for that task anyway.
From a security perspective running everything is root is bad (no disputing that) but I've spent the last decade in/around DFIR work for my day-job and I have observed real attackers and red-team staff compromising LE devices and while I have seen devices being accessed (via known passwords) the attacker has ultimately lost interest in the device because either our distro packaging defeats scripts and other attack tooling and/or because attacker Linux knowledge/assumptions are based on the RHEL/Ubuntu derived world and/or because they couldn't ascertain what the device was for and were cautious as a result. Attackers were never able to compromise devices with basic controls deployed; i.e. SSH/SMB disabled and the firewall enabled. I'd also argue that if you are a genuine target of interest to a real actor, the "runs everything as root" LE box in your home network is the least of your worries.
There are known issues with some of the RK devices and resolutions at the moment (there are some threads in the RK section of the forum). I'm not actively following but I believe they are being looked into.
