> Aren't there other ways of bypassing it with a running machine?

The key element here is that you don't need to be a local admin, just a regular user who has restart permissions.