What is the default user of postgresql?
How does hardcoding the postgres user improve security?
It's not using the root user.
You can use any account you like, but consistency is a Wonderful Thing, especially when you have lots [and lots] of Postgres clusters to manage.
What special rights does the postgres user have?
It installs itself a hole through the local firewall but, otherwise, it's just another user.
What is the upside and downside of using an unprivileged user ?
You should never run applications (or databases) as root (unless they actually need to be).
Always keep the biggest and best tools in the toolbox for yourself, ready to sort out the mess that Applications (or Users) make. If you run stuff as root and it decides to do something really stupid to your machine, you may not be able to fix it.