How i can manage roles for moderators and administrators?

Anyone with write access to the themes can completely hijack a users session. If you don’t trust someone doing that, you should not trust them at all. And if you do trust them, you can just make them admin.