It only needs write access to the block device/file. It'd be the same to move dd to sbin because it can be used to modify block devices/files which the user may not have write permission for. Reproducible: Always
It happens to be upstream's default.