Can you be more specific? If previous LWK approaches were OK, what is different about this?
I think the LWK concept itself is ok, but implementation-wise there need to be some auditing done. This is in a phase going from mostly being a research project to getting some attention and setup for production use on some HPC sites so I'm sure that'll get done in due time.
I doubt the number of possible privilege escalations would be much different from on your average compute node. There might actually be fewer if syscalls could be sanitized before reaching Linux.