I see, thank you for your time and patience spent to explain this. So there's no elevation, no general escape, and this got patched because it could possibly be used as a set-up-use-later backdoor style thing (such as dropping a setuid root binary somewhere in the OS). Yeah, not a thing I would use as an argument that it's a terribly insecure system.