What's the difference though? Not running as administrator will only make UAC display a password prompt if elevation is needed. So if UAC can be bypassed by injecting arbitrary code into explorer.exe then this arbitrary code will get elevated permissions the moment explorer.exe gets elevated permissions...
...whether automatically (in default settings), the first time I need to modify file permissions or copy files to a protected location (admin account, highest UAC protection) or the first time I need to modify the permissions or copy files to a protected location and enter a password (no…