This is one of the reasons sudo should (by default) only allow a whitelist of built-in commands to be run with wildcards.

Somewhat like sudoedit.

This is of course for the corporate case of a less privileged user performing a certain task at elevated privileges. Not for the more common use of sudo (these days) of people managing their own personal machines.