The dirty secret is multi-user died in the 90s and privilege escalation has basically been considered table-stakes since then.
I think this is basically true, but it didn't "die" in the sense that we gave up on it; it just never worked. Systems software was much worse in the 1990s than it today; you could breathe on something with a string of AAAA's and get a 0x41414141 register core dump.
> ... it didn't "die" in the sense that we gave up on it ...
It died in the sense that the "people in charge" hired us for our expertise and then ignored our every suggestion and fought us tooth and nail every inch of the way when we suggested that security or reliability ever mattered in the slightest until after the disaster happened, and then straight-up scapegoated us for "not pushing back harder" against the threats of "go work somewhere else then, code-monkey!" until we gave up and did the "code-monkey" thing for our paycheck and no longer cared about quality or "a job well done".
It died because personal computers got too powerful so nobody bothered designing and building “true” multiuser systems (that bored college students were trying to break).
Back in the 90s, it's not as if any semi competent cs student couldn't slice your typical college server like swiss cheese. People thought null terminated strings were fine back then, and patching everything immediately was rare. So multi user was already dubious.
If memory serves, we were also still also using telnet and broadcasting passwords in the clear for almost all network services.