User accounts and sudo does auditing of who is doing what. They’re are other ways, sure, but checking auth.log is the simplest.

And while lpadmin users can escalate, I’m more interested in escalations from services like web servers or whatever, running as low priv users. I use sudo to allow scripts running as my web server to run specific limited privileged programs as a simple layer of defence.