We always knew this, it has been understood since nearly the dawn of the monokernel OS that there is always a route to privilege escalation somewhere. This is why even for web applications that would be better served by a shell, people choose CGI-style interfaces instead.

The only reason it wasn't seen as a problem was due to the effort and time it took to find and exploit them.