Why not make a proper link /sudo so you don't have to type out the full path every time, which is very inconvenient? (but the fact that such workarounds are needed still means it's a theater)
If your unprivileged user is compromised, you are pretty hosed.
Like, sure you could, but you end up with a very useless system.
Easier to just use VMs for each security context.