I've found out that if we set up a limited payroll permission set just, for example, to allow mark expenses as reimbursed, anyone with that permission set is able to edit and change its own past time offs despite the time off settings explicitly disallows that.
Yes right now the system gives the Payroll manager the ability to override Time Off settings/validations. We plan to expose the ability to configure if the Payroll manager can override or not. This is something we are planning to do in the near future. So stay tuned for updates.