The permission system has little to do with this imo. If you make someone an admin, they hardly need to mess about with writing funky template conditionals to subvert permissions. By definition, if you give AdminCP access to someone who can overwrite template, with or without conditionals, it is someone you trust.
The list of allowed functions is pretty silly anyway. Why aren't the hundred other benign PHP functions allowed? I mean, what damage can one do with 'strlen(...)'.
Anyway, we need not argue. If you think it is a bug, you know what to do.
Cheers