The package pre and post scripts are run as root. These are the things that make sure users and groups exist and other such tweaks to the system. You are essentially trusting the packager doesn’t put anything nasty in there.