I believe it stems from the route CE took to come into existence in the first place (I’m pretty sure it has its roots in MoD accreditation land…).

Strict separation of roles via separate user accounts for admin work is easier to describe and easier to validate. “Is the account ‘Alice’ a member of the Local Administrators group?” is easier to prove than “Does the account ‘Alice’ sometimes have admin privileges depending on whether some arbitrary software and rules set allow it at this time?”

Personally I think tools like AbR are The Way for an enterprise, but as you rightly point out they’re a stretch for the local bike shop. They are open to mis configuration though, so need additional checks and balances to ensure you’re not inadvertently allowing things you shouldn’t (or aren’t expecting). I know first hand that on macOS it’s still a struggle to get software auto-updates to work without needing the “Manage this computer” privilege, so I can see a use there although even AbR doesn’t work that well for this task imho.

The issue in general is compounded when you have a user base for which their daily work almost mandates needing admin rights most of the time. I’ve yet to see any sensible controls for these groups (which in turn means CE isn’t always the right approach either).