On a related note, Polkit, itself, has had its own privilege escalation problems:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4034
https://blog.qualys.com/vulnerabilities-threat-research/2022...
Reply on news.ycombinator.com