Sitecore Gyan : Day 19

An administrator can overwrite any of the workflow states and move an item through the states or publish the item at any given time.

Sitecore Gyan : Day 18

In Sitecore, By default all the codes runs in the security context of the context user.
And if user who doesn't have read access and wanted to perform task on the code then use Security User switcher or Security disabler.

using (new Sitecore.SecurityModel.SecurityDisabler())
{
//put the code here
}