I think there are instances when SQL Server service account will require access to something that it may not be directly under its purview.

Therefore most DBAs keep life simple by making the service account a member of local administrator's group.