The docker daemon is running as root in that scenario. So anyone in the Docker group can trivially become root by starting a privileged container.