My script could plant a trojan su and prepend the path and wait for the user to go root to do its dirty work, or maybe a trojan gui su for the modern desktop.

And there is plenty of nastiness one can do as a *nix desktop user (Send mail, spyware, erase/harvest valuable information). Block all outgoing ports and you'll have a list of "broken" apps as long as the one being trumpeted re SP2.

There has been a push in the Windows dev community to get developers to make their apps non-admin account friendly. I was under the impression that SP2 made this somewhat easier but I could be conflating that with stuff promised for Longhorn. There is definitely a single user OS legacy to shed there.