Can confirm that impersonation will open a hole. Found my first security bug 10 years ago in moodle[1]. It allowed students to impersonate admins with came with full access to the admin panel.

[1]: https://moodle.org/mod/forum/discuss.php?d=87972