Worse - easy way to set the settings then gaslight the user to say they asked for it that way.

How much you wanna bet that it makes those changes in a way that is generally indistinguishable from as if it was done by the user’s own credentials? (Except save perhaps in recall’s own logs)