Thats a windows thing so it can put files in “protected” folders like program files

The unfortunate thing about the UAC prompt is that it gives the software permission to put files in protected folders, but it also gives the software root permission so it can do literally anything else without prompting the user. Except, I believe, if it tries to install unsigned kernel drivers, then the user has to click a new prompt… but you can completely compromise a machine with the permissions that users routinely give to executables that they download from the Internet.