How to define custom permissions for staff, admins, moderators

My point is that if you trust someone enough to change themes then you can make them an admin.

If you would like to allow non-admins to modify themes or otherwise change what a moderator can do you’ll need a custom plugin.