One could fairly argue that maybe such people shouldn't have access to a system, but it is a reality.

More that, such people shouldn't be allowed to be sysadmins, yet self-host and/or expose any ports to the internet.