[wang_li]

If your sudo is configured correctly it will have an administrator defined PATH. However if you have sudo price to run apt-get, anything that could manipulate your rc files can just run sudo apt-get on its own. No need to trick you.

[Godel_unicode]

Unless it doesn't have your password, and sudo is configured to require auth to elevate. This is the STIG requirement for this exact reason

Edit: of course, it could just manipulate the path to include it's own evil sudo wrapper, but the chess match always sounds like this.