Hackers are already leveraging these over-permissioned programs to access the IT systems of major security vendors.
The old saying that the best way to learn is by doing holds as true for penetration testing as for anything else, which is why intentionally vulnerable systems like the Damn Vulnerable Web Application ...