Sudo persists authorization for a short period of time so that you don’t need to re-authorize for back-to-back commands.

Also, once they get ACE they can modify your bashrc to make sudo an alias for “sudo rm -rf / ;” or all sorts of other evil trickery.

it could also alias sudo to some other command

Like "doas".

I set sudo to NOPASSWD, so it doesn’t need one for my workstation