Privileged mode exists to try to increase security (by restricting potentially dangerous actions) when the shell is running under augmented privileges, such as invoked by a setuid program.
Yes, you are correct in that it sounds like "under-privileged", the
-p option is restricting actions that could potentially allow an attack, by perhaps tricking the shell to execute commands under a more privileged user. For instance, that's why it restricts startup scripts, since those might not be owned or controlled by the privileged user in that situation. Also, inheriting functions from the environment can also be dangerous, since one could export a function such as
ls that might be used during the privileged shell and then trigger an action that can be used for an attack.
You also asked about "setuid". In this context, "setuid" usually refers to the permissions of binaries that includes the
04000 bit, for example permission
ls output.) Enabling the "setuid" bit in a binary makes it always run under the effective uid of the owner of that binary. So a setuid binary owned by root will run as root whenever any user executes it. The real uid will be that of the user who invokes it, that's why the
effective uid != real uid check is common in this situation. (BTW, the same exists for "setgid" bit, which is
02000 in file permissions.)
So one likely scenario where
bash -p can be used is a setuid binary which runs as a privileged user (root or otherwise) and wants to spawn a shell, they might use
bash -p for that scenario, since then bash will try to stay more secure (by ignoring startup scripts and functions from the environment, which might be dangerous) and will keep the permissions of the effective uid while running. Invoking it without the
-p option means bash will simply ignore the effective uid (by resetting to the real uid) and behave as if nothing had happened...
There are still many security pitfalls here... So using a privileged bash still requires a lot of thought on how security might be impacted. The measures taken by
-p might help, but need to be considered in the whole context of possible attack scenarios.