Analogous to https://forums.whonix.org/t/whonix-gateway-user-password.
If we ignore physical isolation should we allow everyone in sudoers group (effectively for most users only user user) to run any command using sudo / kdesudo without entering a password?