For most things everyone assumes if you can run arbitrary code you already have total effective control. That is why the gold standard is RCE remote code execution not root.

Privilege escalation is a problem but is the majority of the vulnerabilities found so far. And it is really only a problem in mixed environments where you are expecting to run untrusted code.