That is not true for all systems, a lot of attacks in most systems do not need code execution but do need privilege escalation. Getting privilege escalation by

That is not true for all systems, a lot of attacks in most systems do not need code execution but do need privilege escalation. Getting privilege escalation by definition means that _you are allowed to do stuff you couldn't_ which in itself is an attack vector.