Yes, but that's not really a concern. Physical access with no disk encryption is always 'vulnerable'. What's pretty bad here is that any user now has a backdoo

Yes, but that's not really a concern. Physical access with no disk encryption is always 'vulnerable'. What's pretty bad here is that any user now has a backdoor to obtaining root privileges. That's an awful security flaw.