But System is a very definite context. It has all rights of Adminstrator account on a local machine and no rights on the network. It has no user name/password associated with it, so users cannot log in on it.
That's not the same thing as saying users can't execute code under its authority. Just run a service as System.