Following up on this a bit, it seems that if your Zsh code is executing in a malicious environment (e.g. has done "function /usr/bin/sudo() { echo lol }") is to use a non-qualified path with the "=" prefix.
$ function /usr/bin/sudo { echo lol }
$ /usr/bin/sudo whoami
lol
$ =/usr/bin/sudo whoami
lol
$ =sudo whoami
root
Why does "=sudo" do the correct thing (assuming a sane $PATH, and executes /usr/bin/sudo), but "=/usr/bin/sudo" does the wrong thing (i.e., execute the function)?
Assume "builtin", "command", "exec", etc. have all been overwritten with functions.
Since the environment is malicious, $PATH also cannot be trusted -- I thought "=" might be a way to guarantee that an executable at a specific absolute path does get executed instead of something else (alias, function, autoloadable, etc) but it doesn't work when specifying the full path.