Players on a creative server that are not OP can make a schematic with command blocks in a singleplayer world then deploy and place in the server, thus effectively giving themselves OP.

A possible solution is adding a schematic blacklist tag, or respecting tags like forge:relocation_not_supported

Just discovered they dont keep nbt, so its safeish