[g-b-r]

The arbitrary delete vulnerability scared me at first, but are there really situations where a non-root user can create a new user??

[mtlmtlmtlmtl]

In practice, I doubt it. But sudo offers highly granular permission controls. You can permit a user to only run certain commands as root. So it is a real vuln in the sense that if you give someone that ability, you've now given them more than intended.