Do I need root?

No, and this is not a compromise but a property of the mechanism itself. Android has supported mock locations for development and testing from the start: the system lets one chosen app register test providers and write coordinates into them, and then hands those coordinates to everyone who asks for the location in the usual way.

The app does not interfere with other processes or rewrite system libraries — it uses an officially provided capability that you turned on yourself in developer options. That is why you need neither an unlocked bootloader, nor Magisk, nor Xposed.

The only thing that modifying the firmware fundamentally adds is the ability to hide the fact of spoofing: to remove the “mock source” flag that lets apps tell substituted coordinates from real ones. Everything else the built-in mechanism can do without root.

The price of that ability is high: you lose the warranty, some banking apps and services stop launching because of system integrity checks, firmware updates no longer install normally, and a failed flash can leave the phone unusable. Mock Location works strictly within the built-in mechanism and does not support that path.

The practical conclusion: without root, spoofing is honestly visible to apps that want to see it. Maps, weather, nearby search, your own apps in development and testing — work. Services for which location is proof of a fact (delivery, time tracking, location-based rewards) usually do not, and that is their deliberate choice, not a flaw. More in the article about spoofing without root and in the question on why an app sees real coordinates.