Comment by Kamil Maciorowski on How to set run specific command by root / sudo with password prompt while all other command no password?

There are ways to exclude from NOPASSWD, but security-wise this is pointless: I believe one can run a shell command from vim; and there are other commands that can give the user an elevated shell, thus allowing any command without password. Exceptions to ALL just cannot work.