NFS AUTH_SYS identity spoofing, still the default in NFSv4

Note that the libnfs/LD_PRELOAD demo is an outright lie. By default, nfs3 mounts have "secure" option - it's not really that secure, but it does require privileged client port (<1024). So no, a root-less user can't impersonate a different user to the same machine.

"Reading another user’s files" won't work, "Writing as another user" won't work, "Local impersonation via SUID binary" won't work either. You need root to bind to low port, and if you have it, there is no need to mess with NFS.

It's not to say that NFS is a secure filesystem by modem means - if there are clients where attacker has root access, they can pretend to be any user, and try to spoof IP to bypass access lists. But if used in the circumstances it was designed for - a secure network with only trusted computers connected - it's actually not that bad.