It's installing a brand new VM. By definition, it's got more than just root, it's got enough permissions to bring up new VMs entirely. Being worried about whether it has sudo permissions or something inside the VM is beside the point once you've stipulated that.