Yes, If any malicious program is running in user land in windows, it can easily bypass UAC. But, as was mentioned when this was being discussed on reddit[0], UAC was never meant to be a fix-all security boundary.
0: https://www.reddit.com/r/netsec/comments/6e1uft/a_poc_demons...