This is part of the mechanism used by X server to authenticate client programs.
refer to X Window authorization
The cookie-based authorization methods are based on choosing a magic cookie (an arbitrary piece of data) and passing it to the server when it is started; every client that can prove having knowledge of this cookie is then authorized connection to the server.
These cookies are created by a separate program and stored in the file .Xauthority in the user's home directory, by default. As a result, every program run by the client on the local computer can access this file and therefore the cookie that is necessary for being authorized by the server. If the user wants to start an application from another computer on the network, the cookie has to be copied to that other computer.
when ~/.Xauthority is owned by the root account, normal X client programs couldn't read it and wouldn't be authenticated by X server. this mostly leads to crash.