Services that don't need to run as root (i.e. using ports above 1023) should NEVER be run as root.
If someone hacks a database running as the mysql user, they have your database. You still own the box. If they hack a database running as root, they own your whole box, and can cover their tracks and you'll never notice.