I mean, it's certainly some level of access if there's a local privilege escalation, but it's not "your box is already pwned". Proper isolation and correct permissions on the system will keep the damage isolated. I've seen attacks that were more-or-less nerfed because they couldn't find an open local privilege escalation.

I don't think these should be written off as "Well, you're screwed anyway" like we tend to do when discussing security against an attacker who has direct physical access to the hardware. Isolated user accounts are widely used as the model for running services because they provide significant (if non-total) benefit.