I dunno, seems more like the issue is that the outside attacker's path has gone from "dumb" to "smart". Where before access was done via a limited terminal pro

I dunno, seems more like the issue is that the outside attacker's path has gone from "dumb" to "smart". Where before access was done via a limited terminal protocol, these days it is done via a much richer protocol (or stack of protocols, what with tcp carrying http carrying json or some such). I don't think it was ever that local software was presumed secure. After all you wanted as little as possible to be suid, and if it was it should be as small a piece of code as possible to limit the chance of exploitable bugs.