Hacker News Reader

On Fedora it is setgid screen, not root.

I wonder if there is some selinux policy to reduce the attack surface

There almost certainly is, pretty sure Fedora has an SELinux policy for all software in base.

Likewise in Arch.