On a default installation? They can't but I think they can twiddle things in NetworkManager from the GUI IIRC.
But they also can't get to root via 'sudo' and we have rules for that.
Polkit is basically sudo for DBus stuff and we have rules around what should, and should not, be done with sudo so I guess I expect the same thing with polkit.
For instance, I could use pkexec to run arbitrary commands as root without a password if I have a rule set up for it. But, unlike sudo, there isn't a rule saying not to do that and a method to check for it.
Thanks,
Trevor