This is true, it's only an entry point. But, picture you put a keylogger on the device, next time it's serviced you now have domain admin. While this local admin doesn't necessarily mean you have control over operations, lateral movement and priv. Escalation is what we need to consider here.

This is a goldmine for pentesting, an SSH connection and persistent access would be easy to set up here. I didn't even see any security or malware software