A macOS PackageKit writeup claims a privilege escalation path where a privileged preinstall script invokes Python while still honoring user-controlled startup customization. The concrete path uses `sitecustomize.py`, including a more portable case through `/usr/bin/python3` and `~/Library/Python/3.9`, with the author saying the issue was patched in macOS 26.4.