Bubblewrap is indeed most often used without SUID nowadays; in particular, SUID is generally only used if unprivileged user namespaces are unavailable.
But unprivileged user namespaces are a risk on their own: Code that is supposed to be unprivileged suddenly runs as uid 0. Well, uid 0 "only" in a non-root namespace, but occasionally there have been vulnerabilities that missed the "only".
Indeed there have been CVEs this year where code in a user namespace was able to trigger them where a standard unprivileged process could not (e.g. CVE-2022-0185)