Given physical access, anyone can root a box. So even local users can't/shouldn't have physical access.
"Physical access" means, of course, the presence of a removable-media drive, monitor, keyboard. A box without those is a lot harder to gain access to.
Absolutely. If I have physical access, there is nothing you can do to keep me out of any box, be it a PC, or mainframe.
These days, with the 'live' linux distributions, that is even easier than it used to be.