pt-kill - how to securely allow access to mysql server when running as service
I hope you are not one of my workmates :-) He had to setup a very similar configuration than yours a few weeks ago- you can check our packages if that helps you: Source deb, puppetization.
I told him to use socket-based authentication, it is the same method we use for non-human accounts that only need local-only permissions (icinga, prometheus). You only need to enable the plugin and tell the account with the same name as the account the service is going to run as to use it, so no password is required. Because there is no password, it cannot be stolen, so a compromise of the host would not escalate to a worse issue. Also less things that are private to handle. Unless there is a MySQL bug, the account is as secure as your OS account. You have to create a non-root account for both MySQL (auth_socket will provent password-based authentication and will lock it to localhost only) and the OS (system user with locked login), or otherwise it would defeat the point of it.
If for some reason you cannot use the above, you can still use password-based authentication, but set it on its own configuration file only readable by the user (non-root) that you start the service as.
The point is always to provide the least amount of permissions you can to a service. Root usage not only give the maximum amount, it also overlaps some OS (logging, limits, etc.) and mysql limits (max_connections) you don't want to, even if it effectively has a lots of permissions to kill other processes.