[cracauer]

No question about the headlines overstating.

But I don't think this is a rare situation. For example you can allow a bunch of users to restart and change a buildbot infrastructure (which runs as its own user, not root).

[derekp7]

But you are giving them access to that specific build user, not "ALL" followed by "!root".