You can do dangerous actions in user space without any need for escalated permissions. E.g. downloading a file and running the contents as code, or uploading/e

You can do dangerous actions in user space without any need for escalated permissions. E.g. downloading a file and running the contents as code, or uploading/encrypting all files you have access to. Crowdstrike and Defender handle those possible but suspicious actions.