Using sudo in the exec() isn't really a problem, since any RCE an attacker would get will have the same privileges as the pihole service...they could just use sudo in their RCE if the user is in sudousers (assuming they could even use sudo on their bash session when establishing the reverse shell). In the case of the PoC here, sudo doesn't even come into play, they are stacking commands with && which would require another sudo call to elevate (which they don't do in the example).