Call it less secure than VMs if you prefer that wording.

>not running as root should be an absolutely critical first step for managing risk.

Kinda depends on what angle you come at it from risk management. You could take something less secure (containers) and try to tweak it to meet whatever level of residual risk you deem acceptable. Or you could just jump straight to VM and benefit from the inherent higher level of separation.

The fact that all the big players with their clever engineers have specifically opted for VM tech (e.g. AWS creating firecracker for lambda) tells me the later is probably the way to go.

That said I mostly do stick to containers when in a trusted environment.