Please list here the Access rights of Virtuemart and then you will notice it yourself.
At the moment, I think you do not even know that VM has more than 100 permission rules. All of them are based on joomla.
When your customer should not be allowed to have full control over HIS store, the write this in your customer contract and make him Administrator!
common, that is really, basic shit. It is anywhere the same. Windows, Linux, Mac, wordpress, joomla,... as Superuser, root, Mainadministrator, "theguywhoisresponsibleforanyshit" you are allowed todo anything. Try to delete yourself as superuser, upss, that does not work, so,.. tell me how to delete a superuser if not another superuser is doing it.
So rethink your logic :-) You will notice that your logic is atm not consistent, yet.