That's not entirely true, only software which executes across a security boundary can be used to escalate privileges, exploiting software at the same privilege level that you start at isn't very interesting. One boundary can be remote untrusted users executing a user software like a browser or game to be able to run code as a local user, another is injecting code into the kernel or exploiting an SUID binary to execute with more privileges.