"root" user on my Mac that I did not create

XProtect is a normal macOS process.

See: Protecting against malware in macOS - Apple Support

Q- " Hi everyone. I've got M2 Air on Ventura. "

Q - " Called to Apple and the guy said that the best way to solve this problem is to reinstall OS. Is there any easier way to do that? "

A - Is the user seeing the " Xprotect " like in below image

A - Screen Shot from an M1 Apple machine running Ventura 13.3

A - There are 3 XProtect processes running and are 2 are Root

A - That is very Normal

There is no need to reinstall the OS. In fact the OS is stored in a sealed read-only volume, and cannot be changed, so anything that has been done can at most affect the data volume, not the OS volume.

If you care to post an Etrecheck report, we can have a look and see if there is anything of concern there.

Just to add, if you switch the View to System Processes in Activity Monitor you will see they are all listed as "root". Also perfectly normal.

You're welcome. They don't pop up suddenly. It's just apparently you didn't notice them. 😎

You're most welcome. 😄

Every Unix based operating system since its earliest days at Bell Labs back in the 70’s has had a ‘root’ user.

‘root’ is the only user that is essential to a Unix operating system.