That’s sort of how it works.
Local admin passwords sadly a thing of the past.
I could give a field person that if absolutely necessary which happened a few times.
Safe mode was needed to get rid of a corrupt DLL. Other times local administration was needed was with HP printers mostly field types would buy because they were so cheap.
With LAPS and trying to get a non technical person to function, migraine fuel.