But it's possible to minimize privileges across binaries with that. I think the possible preventable failure is having too much code within setuid/root bounds.