[dotancohen]

Which is arguable an attack vector. Depending on how careless the user is, there is far more likely a chance that malicious code is found in .vimrc than is found in the VIM executable.

[fragmede]

sudoedit runs your editor as you, not root, so unless I'm misunderstanding you, no such attack surface exists.

[masklinn]

They’re probably referring to the attack surfaces of the extensions you have loaded in your normal configuration, as opposed to the probably empty environment of root.