I think if you run a container which in turn runs docker in a way that it can modify "sibling" containers on the host, it needs to be privileged. This can be practical for things like CI/CD, as you can use a docker container to build an updated image and then restart the service that uses that image.

There might be a way to do the same without --privileged, I'm not sure.