I am extremely confused by this, as this seems like at least a bug if not a security issue. If I am not running as root on your server, how am I getting files owned by root at all? A normal user can't just hand files to root, for a number of good reasons. As far as I remember, the behavior of rsync -a if the other side is not running as root is that it just doesn't save the ownership (as opposed to error; "work but the files are owned by root and can no longer be read" is not an option).

Maybe you have made some kind of special dispensation for this, as it would improve the situation for backup purposes, but then it would seem like you got it wrong in a way which I would find super confusing; and, like, are you saying any files owned by users other than root but with other elevated use are fine?