It can be run as root, but it doesn’t have to, as it is only accessing the host network, not any user-specific network. Crossing the boundaries from host network to user-specific networks is left to the reverse proxies running as those specific users.
Port 80 and 443 can normally only be bound as root, but you can work around that with either firewall rules or by using something like this in your sysctl config:
net.ipv4.ip_unprivileged_port_start = 80
In addition to the other replies, zsh gets unbearably slow once you start to actually use all it’s features. Fish is much faster in my experience. Although a lot of the differences disappear once you start using an external prompt like Starship.