Thank you for your post and reminder on this topic.
We also wish (plan) to refine some of the admin controls in the future.
For example, we are interested in a plugin (someday) which will be configured with variables in the yml container file and will restrict certain admin actions (like downloading the full backup of the site) to only certain users (userids).
This plugin idea is “on my plate” and when I get a chance, I’ll look into it more. So far, I have not even taken the first step of looking at the code and examining the feasibility of this idea.