A lot of op mode commands require special privileges. At the moment, that is solved by giving all users sudo rights and using sudo directly in commands, like in https://github.com/vyos/vyos-1x/blob/current/op-mode-definitions/generate-ssh-server-key.xml.in#L17

That approach will become impossible when we re-introduce operator level users who will not have sudo rights. As a prerequisite for the op mode rework, we need to move sudo to an outer layer.