To use sudo normally requires the user's password; to edit bashrc does not. So yes, this is a trivial privilege escalation mechanism of a sort.

It does require though that the user both is allowed to run an interactive shell with sudo, and actually does so, since you have to wait for him to run sudo in bash.

Reminding people that this is a viable threat model is why sudolph.in exists, albeit for the drive-by someone-left-their-laptop-unlocked case rather than regular local privilege escalation.

I should probably add a check for catching someone within the sudo timeout and give them a hard time if so.

Running sudo requires the user password, which a script might not know. Unless of course sudo is configured with NOPASSWD.