This depends on the setup really; it's possible to limit sudo access to only some commands, like so:

  %veracryptusers ALL=(root) NOPASSWD:/usr/bin/veracrypt

An inexperienced systems administrator might use this to allow some users access to the mount command so that users can use their encrypted USB drives to carry around sensitive data, not realizing that through the intricacies of the Linux filesystem this can lead to privilege escalation.

Such a config would normally give you sudo, but not a root shell; allowing certain users to use ping floods to test the network by giving them access to the ping command as root, for example, would not expose much security risks other than flooding the network.