>Compromising an user account is a necessary step to get there, often enough.

But whether you have an elevated token or not won’t make a difference in almost all cases.