Why am I able to open Wireshark and capture packets in macOS without root privileges?
The reason is that the Wireshark installer installs a LaunchDaemon (i.e. something that runs with superuser privileges on boot) for setting special permissions to capture network packets. More specifically you can look at the file /Library/LaunchDaemon/org.wireshark.ChmodBPF.plist to see what it does and when it is run.

As creating these LaunchDaemons require superuser privileges in itself, the Wireshark installer requires you to be a superuser (i.e. you have to enter an administrator user password to install the software).

If you look at the actual script run by the LaunchDaemon in /Library/Application Support/Wireshark/ChmodBPF/ChmodBPF, you'll see that it creates 256 devices entries /dev/bpf0 to /dev/bpf255 and sets to that everyone in the access_bpf group can read and write to these device files.

The access_bpf groups is actually also created by Wireshark installer. This also requires superuser privileges. If you open System Preferences and then Users &amp; Groups, you'll be able to fold out the "Groups" part of the tree and see "access_bpf" listed there. You can then add/remove users from that group to give or remove permission to capture network packets within Wireshark.