Hmm, never had cups-browsed enabled as I do not need network printing with LDAP or legacy cups. Discovery using DNS-SD/mDNS and driverless printing work perfectly fine without it.
I am not sure if the driverless discovery ever can generate a PPD with arbitrary commands.
Is it common for cups to run as root? It should have its own user, but that is still not good.