They dont require physical access, but they require access to a non-root account on the machine. How often do you create accounts on your local machine for malicious actors to use?

When you do a new OS install, do you create a separate user account for guests and then share the login details with random people?