If an attacker can get elevated privileges through an user account, the users themselves can do so as well. And you shouldn't trust them either, so you need to

If an attacker can get elevated privileges through an user account, the users themselves can do so as well. And you shouldn't trust them either, so you need to assume they have if they could have. That means definitely reinstall when you find out you've been vulnerable to e.g. a local root exploit, regardless of user accounts have been hacked.