The threat model of sudo is a little different. You already have authenticated access and sudo is requesting elevated access. Even a static button on the comput

The threat model of sudo is a little different. You already have authenticated access and sudo is requesting elevated access. Even a static button on the computer would provide benefit since it alerts the user a program is attempting to obtain elevated privileges. For comparison, Windows default configuration is a yes/no dialog (UAC). If an attacker had unelevated access they probably stand a pretty good chance of getting elevated access on a workstation (replacing files, putting a shim in front of sudo, stealing SSH keys, access tokens, cookies, etc) anyway (if the regular user has those privileges)