Yeah, they do, but (in theory) they should either only allow you to do some very restricted commands (e.g. chsh, chpasswd), or require you to authenticate to run arbitrary commands (e.g. su, sudo).
The former are fine since they don’t allow arbitrary commands/escalation, and the latter (IMO) you should not use because it’s impossible to use them safely as you can’t trust the environment (the display server, terminal emulator, shell, etc.) to do what you say if it is compromised.
In practice, some of them will have bugs (and the kernel also has privilege escalation bugs frequently) so I don’t consider the user/root separation a particularly strong security boundary. For me it’s more of an additional layer against not very sophisticated attacks.
You would not be able to change your password without the functionality.