While following the documentation provided by Azure and Hashicorp, I’ve created a test custom image and a subsequent virtual machine in Azure, although everything works as documented, there is an entry left behind in /etc/sudoers.d/90-cloud-init-users file granting the packer user full control of the box without having to enter a password.
While the risk is reduced by as the “packer” user does not exist in the box, there is still a substantial risk for the end-user if they happen to create a “packer” user and do not intend to give full superuser access to the newly created username.