Agreed,
I run WP and, unless the admin is malignant towards your server,
this is nothing but simple template editing wich can be done..
normally, as admin with perms.. ofc, if you have a bad apple in the
bunch, it will eventually showup in some way.. this is just a level
of trust given to WP-Admins, wich Could or could-NOT be compromised,
depends on your admins... I know on my site, thats not a possible
scenario to attack this and exploit, simply dont have admins :>
