Staff Member can Get POS Access Without User Interaction

I found that it is possible for a staff member to grant themselves POS access without user interaction from admin.

{"query":"mutation {retailUserDataUpdate(id:\"gid://shopify/StaffMember/63779504283\",retailUserData:{posAccess:true,pin:\"1423\"}){staffMember{name canAccessPrivateApps authenticationSettings{tfaEnabled}}userErrors{message}}}"}