> Or an accidentally ran with `sudo` program can indeed screw your entire boot process and inject rootkits etc.?

The more realistic scenario would be exploiting a privilege escalation bug. Of which there have been and will be plenty of on both Windows and Linux.