It is not that they necessarily have access, they are just on the network and have a route to the server IP. You can set up your network topology differently if you want, but it has nothing to do with what OS the executives have.
When I was working, I worked at a major bank. They set up a network for executives and vendors that was completely separate from the main network. They had their own set of IP addresses and were completely isolated from the main processing network of the bank.
And if they were smart, their DNS servers couldn't even resolve the internal production back-end systems in the first place.