The question here is: do you want to allow *any* logged users access the devices managed by avrdude or do you want to create a dedicate group (like Debian) and selectively put users in this group ? It seems that the second option is saner.