Usually the way to be able to even get the login screen is to use DRM/KMS based capture and use uinput for device emulation. It doesn't strictly need root but it does need privileges a user wouldn't have, like access to the DRM card nodes and uinput device. Sunshine does it this way.

It entirely sidesteps the problem of X vs Wayland, although this does mean the unattended physical seat can be physically taken over while you are remote.

Yea I need to know this before I even consider something like this. I'm guessing it's a daemon that runs as root in the background.