Isn't this validly described as "it lets you execute commands as a particular user on a particular host, but requires you to first execute a command as that use

Isn't this validly described as "it lets you execute commands as a particular user on a particular host, but requires you to first execute a command as that user on that host"? Even in "defense in depth" or "zero-trust networking" paradigms, what does this ever let attackers do that they couldn't do already?