What about SSH?

polkit does have its own sudo-like tool, pkexec, which I personally think is a more concerning attack surface than polkit itself (because it's setuid root and therefore needs to distrust its execution environment, just like sudo, doas and everything similar). In recent Debian/Ubuntu, pkexec is packaged separately, so that it doesn't need to be installed on every system that has polkitd.