I've noticed that after uninstalling the
postgresql package in ArchLinux the
postgres user and group are not removed automatically. The same is true for some other packages. Investigating this further, I've come across this page, which states:
The packages listed here use
groupdelto remove the user they created. These should never be removed automatically as it poses a security risk if any files are left behind with this ownership.
I wonder why leaving files with this ownership poses a security risk?