But this doesn't work if I create a deployment out of "default" namespace:

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: user70001
  name: user70001
spec:
  replicas: 1
  selector:
    matchLabels:
      app: user70001
  strategy: {}
  template:
    metadata:
      creationTimestamp: null
      labels:
        app: user70001
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 70001
        runAsGroup: 70001        
      containers:
      - args:
        - sleep
        - INF
        image: <http://docker.io/busybox:1.35|docker.io/busybox:1.35>
        name: busybox

I was able to manage RunAsUser key rules using customized criterion. None of my tests using "User" criterion worked for me. In my case I prepared a deny rule for userIDs greater than a defined number for all namespaces with few exceptions and added for these namespaces specific rules with specific userIDs.