I run a university computer lab and could never give out admin rights to students.
Anybody who runs a Boot Camp VM has, from within the VM, full access to the Windows partition on the physical disk. So they can for example rewrite the bootloader of the physical disk to take full control of the host next time it is rebooted. So allowing somebody to run a Boot Camp VM is equivalent to allowing them to elevate their privileges to that of a host admin.
So Fusion is faced with 2 choices when somebody wants to run a Boot Camp VM:
1) Silently allow it. This is insecure as explained above.
2) Prompt for a host admin password. This is secure: if the user is already a host admin, they don't need the help of a Boot Camp VM to elevate their privileges to host admin.
We chose the secure way. So did all our competitors.
