[ken_yap]

It's less risky but there is still the possibility to take advantage of typing mistakes. The user could plant a command which is close to an existing command, e.g. nestat, when root meant to type netstat. The nestat command would then silently grant the user root privileges (one way is to bless a command as root setuid), and then exit with "nestat not found". Nothing would seem amiss.