Are you just asking how a user-mode program can write files? User-mode (ring 3) does not mean unprivileged, although kernel-mode (ring 0, the opposite of user-mode) does imply privileged. Every time you
sudo a command, you're running ring 3 code that can modify arbitrary files. The "root" user's programs run in ring 3 just the same as anybody else's.
A rootkit like this obviously requires privileges (i.e. root) in order to install. It does things like create a user, which can be done with userspace code (there are some calls into the kernel, but you don't have to install a kernel module to do it) but cannot be done by an unprivileged user.
As a side note, user-mode rootkits are weaker than kernel-mode ones. As a practical matter, third-party code will essentially never make a system call directly, because system calls are not like "normal" functions and the details are platform- and implementation-specific, and might change between major kernel revisions. Making syscalls directly from your code will likely make it non-portable, and is easy to screw up. However, it is possible, and if you do that, you will bypass the shim that the user-mode rootkit has set up to tamper with your syscalls.