In WSS v2 (SPS 2003) this was indeed a problem. But since v2 SP1, IT
staff (ICT) does not have access to content unless they grant themselves
access (an auditable event) or are granted access by the content owner.
So, briefly, if the ITC members are not individually or a member of any
AD Group that is listed: as a Site Collection Administrator, in any
SharePoint Groups, in any role assignments (Advanced Permissions link in
Site Settings), AND there isn't any Web Application policy granting them
access then they don't have access. They cannot even "see the documents
that are in it".
Setting unique permissions on the Web, List/Library, Folder, or even the
Item (WLFI) do not improve/enhance the previous statement; they just
make it possible to have a different sets of people with access to the
given WLFI.
While ITC members do not have access by default, those that have access
to Central Administration (Farm Administrators) could at any time grant
themselves access using either a Web Application Policy (auditable!), by
making themselves a Site Collection Administrator (auditable, I think),
or by adding themselves to an AD Group that has access (auditable, I
don't know). But as you point out, those same administrators could grant
themselves access to absolutely any networked storage location including
the local c: drive that the "Head of the company" uses.
BillG himself had this concern (I've been told) and was the catalyst for
the current security structure (ops has no access to content without
audit). You can imagine that he didn't want the documents that he put in
the Document Library in his private My Site to be visible in any way to
the snot-nosed college intern helping in network operations. To my
knowledge, BillG is satisfied with the current implementation, as am I.