It is irrelevant though. If your whole multi-billion company folds like a wet towel when one user is compromised, the question isn't how that user is going to get pwned, it's when.

Relevant xkcd: https://xkcd.com/538/

If you really really want one user to control everything, maybe they should work on a desktop station with a guard at the door.