Verified with CNV-v4.13.0.rhel9-1836:
[cloud-user@ocp-ipi-executor-xl must-gather-vm-2-1679941614-426225]$ oc get hyperconverged kubevirt-hyperconverged -n openshift-cnv -o json | jq ".spec.featureGates"
{
  "deployKubeSecondaryDNS": false,
  "deployTektonTaskResources": false,
  "enableCommonBootImageImport": true,
  "nonRoot": true,
  "withHostPassthroughCPU": false
}
[cloud-user@ocp-ipi-executor-xl must-gather-vm-2-1679941614-426225]$ 

I don't see root: false

The idea was exactly to keep nonRoot (with a default of True) on the HCO CR to avoid introducing a user visible change on APIs so late in the game internally translating it to Root on the kubevirt CR (with negated semantic).

I checked on v4.13.0.rhel9-1808

Setting NonRoot: false in HRoCR and checking if virtlauncher pod is root also we see Root feature gate in KV CR
[akriti@fedora cnv-tests]$ oc get hyperconverged kubevirt-hyperconverged -n openshift-cnv -o yaml | grep -A 8 "featureGates"
  featureGates:
    deployKubeSecondaryDNS: false
    deployTektonTaskResources: false
    enableCommonBootImageImport: true
    nonRoot: false
    withHostPassthroughCPU: false

[akriti@fedora cnv-tests]$ oc -n test-bugs get pods virt-launcher-example-f284x -o json | jq .spec.securityContext.runAsUser
0

[akriti@fedora cnv-tests]$ oc get kubevirt kubevirt-kubevirt-hyperconverged -n openshift-cnv -o yaml | grep -A 20 "featureGates"
      featureGates:
      - DataVolumes
      - SRIOV
      - CPUManager
      - CPUNodeDiscovery
      - Snapshot
      - HotplugVolumes
      - ExpandDisks
      - GPU
      - HostDevices
      - DownwardMetrics
      - NUMA
      - VMExport
      - DisableCustomSELinuxPolicy
      - KubevirtSeccompProfile
      - WithHostModelCPU
      - HypervStrictCheck
      - Root

virt launcher is now running as root , implies we can configure Root feature gate by setting nonRoot: false in Hco CR

based  on comment 3
Marking it verified

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: OpenShift Virtualization 4.13.0 Images security, bug fix, and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2023:3205