Malware can be installed by users accounts running with full Administrator privileges, or in standard accounts by programs exploiting privilege escalation.
Privilege escalation is an exploit of an OS or application that acquires elevated access to resources that are normally protected from an application or user. That gives an application more privileges than intended, and can then provide privileges to perform unauthorized actions.
Many legacy versions of Windows created default users as administrators. Even today, many users user these admin accounts as their default logins.
If certain security features are not secured or configured properly (User Account Control), and/or a user is running as an Administrator type user, or via privilege escalation, then it is quite trivial to install any program as a service: either as a named service, or more stealthily, as a program running under svchost.exe, where it will be placed in a particular service group, which is then launched by svchost.exe.
Most email "phishing" attacks rely on these vulnerabilities: The UPS "package delivered notifications", the Better Business Bureau, etc.