If an attacker has arbitrary code execution as a user with sudo access (ie, basically any developer system), then the user/root distinction is basically meaningless.