It is in general bad practice to operate a service as root. But it is good practice to run service with a special user for instance to restrict areas where the user is allowed to operate with the file system.
**So yes, you have to create a separate user to operate the engine securely.**
This is also covered in our getting stared guide: https://developer.axonivy.com/doc/latest/EngineGuideHtml/gettingstarted.html#gettingstarted-linux
