The help files will explain this. Local Admins have read access  and
change security  access anywhere in the system. Sharepoint will override
any deny access account when the account is a local admin. The only way
to limit the privileges of a Local Admin account is to limit the local
admin account members to those are trusted within your org.