Technically when you boot to single user mode you are operating with admin permissions. But it is a technicality which really isn't relevant to the discussion.

Technically when you boot to single user mode you are operating with admin permissions. But it is a technicality which really isn't relevant to the discussion. If someone has physical access to your device and can access single user/recovery mode then you are screwed to start with. This applies across macOS, Linux and Windows. Adding a hidden account is one of a long laundry list of exploits which can be accomplished in these modes. If you are concerned about these then you should apply a boot time password. Apple recommends doing just this help prevent single mode exploits. If you are concerned about supply chain attacks prior to receiving the device then you should be wiping the machine and reinstalling the OS prior to use. This is exactly what many organizations do.