> they can’t just run unsigned code etc.

They can do everything that the escort's account can, I don't think you can know what that is.

Since it's to solve technical issues, there's a high chance that low-level access will be required, often.