Comment by IshKebab

> If you require password authentication when running sudo then an attacker has to find a RCE exploit and then crack a password.

Nope! Just alias sudo to something that logs the password.