You have to bear in mind that a user with local administrator rights can literally do anything they want, including for example, attaching a debugger to
sqlservr.exe process and modifying code or memory directly. They could also take ownership of the
master database file and modify it with a hex editor.
You cannot lock them out, because there are many ways for them to elevate to
SYSTEM rights, at which point they can do anything they want anyway.
For example, one of the methods on the excellent post linked by @StephenMorris uses impersonation. An administrator can impersonate any user, so they could act as the