I was taught "least privilege" was a fundamental principle of computer security. I guess this guy was taught differently.

Actually, it's more like this. I remember when I used to blame my users for what my software could do.