Surely you could get them to execute something via an e.g. .deb package? Or is there security in-built somehow?

What if there is a security bug that permits escalation? Windows defaults to limited permissions now also BTW.