So there's one idea that sent me thinking: that actually sounds reasonable, even if inconvenient - remove self from wheel/doas/sudo, and switch VTs to escalate privileges. The reason why this is more secure is because no software running as an unprivileged user could simulate the physical keystrokes necessary for the VT switch. But why does it have to be so inconvenient, what if we could eat the cake and have it too? Maybe just require pressing a certain key combo on the physical keyboard whenever prompted for a password by su/doas/sudo?

Then I remembered! Windows NT did exactly that: you had to press ctrl+alt+del to log in.