“Do not be afraid to temporarily decrease your privileges if it might help you get higher privileges on the way out.”
Snyk went from the default user on a fresh Ubuntu 24.04 desktop to root. The chain was a small CUPS bug, Polkit rules, AppArmor gaps and a wpa_supplicant DBus method that loaded any shared object it was handed. Nothing in it is exotic. It is the default printing and Wi-Fi stack on a long-term-support release, and each piece trusted the next.