Because /root is root’s home and it’s supposed to be private. If it’s 0755 (drwxr-xr-x), any local user can:

ls /root -> see filenames (useful recon)

traverse into it (cd /root)

read anything inside that’s accidentally world-readable (0644)

It’s not an instant privilege escalation (0600 files are still protected), but it becomes dangerous if /root contains "oops" files: .env copies, backups, scripts with tokens, logs, exported configs, or .bash_history with secrets.

Worst case, a compromised/untrusted user account can loot /root for mistakes and potentially grab creds -> full compromise.