Some deployments restricted the module installations and updates through the web admin properties. Since the SysAdmins mostly works through the REST, it's failed to address this feature for the end users. So anyone from the system who is able to access the System Admin OWA can able to start/stop modules and install the modules.
So we should add the fix to restrict the user actions along with the Web Admin properties.
OWA-69 for the implementation