How can a process use a newly created pseudo-terminal if only root can open it?

I'm currently learning about the TTY system, and I want to create a demo application which opens /dev/pts/ptmx which will create a new terminal, and then have a process create a new session which will open this new terminal and be controlled by it. But something is very weird. In order to open /dev/pts/ptmx you must be root. Now, when you open /dev/pts/ptmx, you get a file descriptor which you should pass to grantpts, which will "change the owner and mode of the slave ... device corresponding to the master pseudo-terminal corresponding to fd. The user ID of the slave the real UID of the calling process". But the calling process must be run by root in order to open /dev/pts/ptmx, and only there you have the file descriptor... what gives?