I think that were I to implement anything like this I would document the capability explicitly.
The situation that seems useful to me is bypassing dysfunctional processes rather than circumventing inconvenient policies.
(and if the device in question can auto-apply updates so far as I can see being able to ssh into it rather than ship it an update that Does Something is more a question of how convenient it is to Do The Thing rather than adding any additional Things that it Can Do, though it's entirely possible I'm missing something important there)
The situation that seems useful to me is bypassing dysfunctional processes rather than circumventing inconvenient policies.
(and if the device in question can auto-apply updates so far as I can see being able to ssh into it rather than ship it an update that Does Something is more a question of how convenient it is to Do The Thing rather than adding any additional Things that it Can Do, though it's entirely possible I'm missing something important there)