Windows can do things that require UAC without prompting for UAC.
For example, Windows can change any file in C:\Windows without requiring UAC. Could a malicious program "pretend" to be windows and do the same kind of thing, but with worse results?
Acting as Windows is called running as SYSTEM. SYSTEM is the user account that has the lowest level access and can do anything on, well, the system. Windows uses the SYSTEM account to run key services that keeps the system in order.
If you can run as SYSTEM then yes you can pretty much do anything you want on that machine. The problem is that it's really difficult (relatively speaking) to get a program to run as SYSTEM, as you need administrative permissions to do so.