Users should never be able to change the themes for others. Only admins should do that.
I think the admin should have the ability to globally change the themes. There may be some instances where the admin abuses this power but I think the vast majority won't use it on a "whim". I see it as a necessary tool to control your brand.
Brand Conrol is a very good use, but the users are selecting their theme from a finite 'controlled' set of choices, that I would assume as brand compliant (if you could put it that way). But yes, we need to secure this portlet for the Final release for sure.