For all of my time being aware of this industry, it has generally been understood that privilege escalation bugs are common. This has always been a thing. A lot of people say, commonly and for many years, that if your security depends on there not being privilege escalation bugs, you don't have security.
Raymond Chen from OldNewThing said multiple times that the Windows security team doesnt worry too much about local privilege escalation vulns because they know there are dozens of them (well, now probably thousands) and said the same thing, if you rely on there being no LPE, you dont have security
This. Privilege escalation locally is almost a given in most cases.