Thanks for the link, this is a much clearer example of how prototype pollution can be an important vector.

As another commenter noted, if one can directly inject literal JS code that writes to __proto__, you've already got RCE.

The case where prototype pollution happens without arbitrary RCE looks like:

- User input can set arbitrary fields of an object and its properties, allowing the user to add or alter a field on a `__proto__` that references a widely-shared prototype;

- The existence or value of that field non-locally affects other code which assumes that the prototype is not under user control.