Than was my first reaction when I realized that logged in with GUI (X11) user can turn off (and on) network interfaces. Without being in sudoers file.
Would not being in sudoers prevent them from pulling the cord out? The rational for the control is well justified for users with multiple interfaces and is simply a convenience to something they could always do under any condition anyway.