You think you're joking, but I've been on one site, nameless to protect the guilty, where the sysadmins did not (for stupid political reasons) have the ability to change the password, and had long forgotten what that password was, and where auditors forbade the installation of additional privileged binaries -- so, rather than use sudo or something like that, they kept an exploit binary around to give them a root shell 'because it works as long as we don't upgrade the kernel'.
(I pointed out how stunningly unwise this was, and was told that this was the way they'd always done it and they weren't going to change.)