I’m not the developer who wrote this, so I don’t really know the full story behind this.
It occurred to me too that’s slightly odd a user’s configuration is stored system wide. There shouldn’t be too much concern over security as it literally creates/modifies a file in the code in a privileged location, where the other default panels are. Presumably the developer did that to simplify the code rather than having to look in two places.
As with @Bill_MI’s link, if I had/have time, If like to see this improved. I don’t believe there’s any need to be root, since you can change to any panel layout without authentication.