An infection is an infection regardless of how long it stays in the system (ie, whether it survices a reboot or not), and regardless of how entrenched it is (ie, whether it has attached itself to the kernel or only in userland space).
I don't want to rant on, so here's a simple scenario: you're browsing the interweb tubes and got hit by a drive-by malware vid a legitimate, but compromised site, due to a zero-day/unfixed browser bug. It starts collecting data and files (maybe even log key strokes on the browser) and sends it to the malware author.
You're screwed.
Questions: Did it had to infect the system/kernel? Did it had to survive a system reboot? Did it had to access ALL of the files in the system? Did it had to have root access?
Answer: No. It does not even have to and you still got your data "stolen".
Moral of the story: No matter how hardened you system/kernel maybe, it is always the weakest link that screws you; in this case, a compromised application. And running as a non-admin only lessens the threat, but not eliminate it. If you're running your applications as yourself (and not as a different, non-admin user or a lower-privilege user), then it has access to your files.