The backdoor is `sudo` and if you allow passwordless `sudo` then any program you execute has permissions to run code as root. If you require a password to `sudo` then there&#x27;s less of an issue as even the LetsEncrypt client would require you to grant permissions to `apt-get`.<p>That all said, it&#x27;s still bad form to `apt-get -y` when run with a `--help` flag. Particularly with the `-y flag`. Even if you trust LetsEncrypt (and most of us would), it&#x27;s still unexpected &#x2F; non-idiomatic behavior and the `-y` flag means users don&#x27;t get much time to cancel the operation should any output concern them.