Reading https://support.apple.com/en-us/HT208198, the official way to do it requires booting from Mac OS recovery and entering an administrator password.

⇒ there may of course be bugs, but Apple’s intent is there isn’t any way for malware to do that