For as long as I can remember, it’s been possible to configure WordPress like this: In essence, this combination of settings translates to: “Please take my site. No seriously, it’s yours.“. Allowing new users to sign up, and then making them site administrators allows them to completely take over your site.
I’m really surprised that this is not a heavily protected option and can’t think of a reason people would really want to do such a thing.