An implementation detail where TLAs could theoretically get root remotely? Seems like a bit more than a detail to be glossed over.