I'll have to refresh myself and read the current discussion, but remember the priv-dropping is only effective permissions. This is to protect osquery from damaging the system. It does not protect against intentional attacks against osquery, fairly obvious though since after dropping osquery resumes its elevated privilege. There were never plans to make this a security mitigation, that would be complex.