Wait, why does that make a difference? If an attacker can get you to run privileged malicious code once, they've won. This seems like the Windows-land equivale

Wait, why does that make a difference? If an attacker can get you to run privileged malicious code once, they've won. This seems like the Windows-land equivalent of the old GNU ldd bug - it's rare that you use ldd and rarer still that a sysadmin runs it as root on a user-provided binary, but once they do, the user can immediately escalate privileges (and use whatever means they like for persistence).