I'm guessing they are making an implicit distinction between access as the user, vs with the privs of the user. In the second case, the process has permission

I'm guessing they are making an implicit distinction between access as the user, vs with the privs of the user. In the second case, the process has permission to do whatever it wants, it elects to restrain itself. Which is obviously subject to many more bugs then the first approach.