Hector Martin

Some of them even ran their own confused tests and thought it was really that bad, because sudoers is confusing and they didn't understand exactly what config they needed to have. They often accidentally gave themselves ALL outright.

Honestly, you didn't do a great job of conveying the details. The most confusing bit is where you go straight from ALL to "in a specific scenario where you have been allowed to run a specific, or any, command as any other user except the root"

That reads as "any other specific user", because the actual idea of "literally any user in the system, except for root" is so baroque that nobody thinks of it. You really need to dig into that point because it's very hard to grasp.

What everyone took from that line is "a sudoers config which lets you run something as www-data lets you run it as root" which is not the case.

Who the heck lets www-data impersonate all users? That makes no sense. The point is it basically applies to no real configs.