Wow! I didn’t know there was an admin allow-list! I’d guess it’ll take network addresses so you can give it a whole class C or whatever.
They’d need another admin to update the setting. But I would assume that this would be used when the admin uses a vpn to the company network, so if the address changed, it would mean he was no longer allowed to be an admin.