And who runs their webserver as root? (Or who changes the permissions on /etc/shadow to allow it be read by a non-root process).

Having to be root to be able to bind to a TCP port <1024 is no longer necessary on a modern OS.