Okay thats correct.
However in a good env. a user should also install an application without consultion an admin. Applications which want admin rights do really need a good reason for that -
imho.
I hate apps which always want admin rights - i do not install them at all.
A service and its client app is truly a team. Any client app can send messages to the service. However the service must always check the input.
The client app can be signed with a reliable certificate which can be checked by the service. To create such a certifcate is simple but expensive. Reliable organisations want money for that.