SQL 2008: Why is *any* user, with minimal permissions able to restart/stop the SQL instance through Management Studio
Correct Answer:
It looks like SSMS looks at the context of the user who opens up SSMS itself, and not the user who connects to the DB engine.

I was able to log in to MS SQL Server as a SQL Server user and I was still able to restart the service under these 2 conditions:


Logged in directly into the server via RDP as a user with admin or start/stop services rights, opened up SSMS, and was able to restart it
Opened up SSMS across a different domain impersonating a domain user which has admin rights on that box using /runas netuse.  


Original Answer (Partially Correct):
It seems you might be confusing "MS SQL Server" permissions and "Windows" permissions. The MS SQL Server user permissions don't control access to Windows Services, a MS Windows domain or local user server controls who can or cannot restart the services.  You can modify these settings through secpol.msc.

If you log in to MS SQL Server as a SQL Server user (even sa or a sa equivalent user) the 'restart' option is greyed out.  If you log in to it as a "Windows User" who also has admin or restart services to the Windows machine, then you can restart it.