Why is that significantly more serious than them running any other backdoor as a normal user?
I don't understand the threat model here, it is always completely unreasonable to expect that an attacker wouldn't easily be able to escalate privileges locally in a multi-user system.
