The example contains an asterisk in the allowed commands field. That's not something you would normally do with users who would not otherwise have root privileg

The example contains an asterisk in the allowed commands field. That's not something you would normally do with users who would not otherwise have root privileges. There are (figuratively) an unlimited number of ways to compose commands that do arbitrary things. Security audits explode in complexity. Always list every literal command that is allowed. Make a command wrapper if necessary. (Also, never allow arbitrary environment variables.)