As was said multiple times: once the program is running and has enough access rights (administrator), it can do anything if written in a clever way.
So, it’s important not to allow it to run at all in the first time.