I have no idea why you assume admin was separate from curriculum. I have run them combined for around 13 years now.
I think you should take a deeper look into how active directory works and the different ways you can grant or deny permissions and on what levels. Suffice to say, allowing authenticated workstations read access to the SIMS set up folders is very unlikely to result in a compromised system.
I am sure you could walk into my school and plug in your laptop, but the dhcp server giving it to you would be the one on our guest vlan. Have fun with that. Managed switches - look into them.
You do know SIMS runs on SQL? Because who stores a database file on a file server? Especially one as inefficient as the SIMS database. Not even the LEA stores the SIMS database there.
I guess you work in a primary school using RM where things like you describe do go on, but please don't assume everyone is on your level.
May I suggest that in the future, when you hear or read, a different way of doing things you take a step back and think before attacking it just because it is different from the way you do things. I offered someone a solution, and you leapt out to attack it, basing all your attacks on assumptions.
I have just checked, and I have SIMS on 117 computers. To upgrade these takes me a few seconds to change a batch file. Then when they switch on in the morning they upgrade. This has worked without fault for a very long time because I took the time to work it out and try something new.
Maybe you should too.