Course certificates are sent out regardless of completion criteria for any system level admin users enrolled in a course as a student.

To replicate:

1. Add a course certificate to a course that is only available under certain restrictions.
2. Enrol a system level admin user as a student in the course
3. Once the "\mod_coursecertificate\task\issue_certificates_task" scheduled task runs, it will issue a certificate the that user regardless of any criteria

The issue is from mod/coursecertificate/classes/helper.php, specifically the get_users_to_issue function:

          // Filter only users without 'viewall' capabilities and with access to the activity.

          $users = [];

          foreach ($filteredusers as $filtereduser) {

              if (info_module::is_user_visible($cm, $filtereduser->id, false)) {

                  $users[] = $filtereduser;

              }

          }

          return $users;

The "is_user_visible" will return true for admin users in the course enrolled as a student.  The logic should be changed here to account for any users enrolled in the course with elevated permissions.