Why can an app create daemons on the fly without sudo permission and how to stop it?
The general security model is that normal users can add any startup items to their realm (user library for them) and not for the system, so don’t let people have admin accounts if you don’t trust them to not run software that installer system level startup items.

There is no easy way to stop an admin user from changing the system. You can enforce gatekeeper or signed apps, but most admin users can bypass that setting so at best, you slow down an uneducated admin user for a bit.

Per-user and Computer Wide Jobs

On macOS, launchd can manage background processes per-user and computer wide.

Per-user jobs exist within your user session. They start and stop with your logging in and out of the computer. If the jobs have associated job tickets, you will find them with the folder ~/Library/LaunchAgents and ~/Library/LaunchDaemons

Computer wide jobs start and stop with the computer. These jobs are stored in /Library/LaunchAgents and /Library/LaunchDaemons.

Computer wide jobs managed by Apple are stored in /System/Library/LaunchAgents and /System/Library/LaunchDaemons.

Per-user jobs do not need super user permission. Thus you did not need sudo to stop jobs installed at the user level by vox.app.

Disabling a launchd job

You can unload a launchd job to block it returning:


  Usage: launchctl unload &lt;service-path, service-path2, ...&gt;
  
  
  -w Additionally disables the service such that future load operations will result in a service which launchd tracks but cannot be launched or discovered in any way.
  -S &lt;session&gt; Only unloads the services associated with the specified session.
  -D &lt;domain&gt; Unloads launchd.plist(5) files from the specified domain. See the discussion regarding this same flag when given to the load subcommand for further details.
  


The -w causes the unload to be written to disk and to persist across sessions.

For more about stopping, unloading, and overriding jobs see:


Launchctl difference between load and start, unload and stop
Disable Services in OSX (services.msc)
launchctl - remove enabled/disabled override