I've never seen a university network that prohibited CS grad students from having machines with root.
I've heard of networks like this—in some places I didn't expect—but it is neither acceptable for a research environment nor the status quo and you should push for changes in your department if this type of harebrained thing is preventing your ability to do science.
Oh, I do have root on my own desktop machine. It's getting root on a machine that I can use to serve things up to the internet that's a hassle. The official way to deploy web-app type stuff is to ask university IT to look it over and deploy it on their servers, which they understandably don't much like doing when the webapp includes callouts to a bunch of possibly-buggy research code, some of it from third parties, or depends on stuff they don't have installed on their servers (Prolog, Lisp, etc.). But they also don't like un-firewalling my machine so I can just serve it up from there. Research groups can indeed set up servers that they request to be un-firewalled (a prof. usually has to initiate that), but it's just less of a hassle for me to move web-demo stuff to a VPS.
I've heard of networks like this—in some places I didn't expect—but it is neither acceptable for a research environment nor the status quo and you should push for changes in your department if this type of harebrained thing is preventing your ability to do science.