Not automotive, so at a more abstract level:
Regulatory requirements: if applicable, cannot be waived or conceded. There are however frameworks for dealing with ambiguity, out-of-scope. This includes technical certification.
Standard requirements: preference should be to not waive or concede, however the accreditation/certification body ultimately decides. Absence of a decision is not permission. Absence of planned monitoring on an item is not a decision.
QMS requirements: Top management decides the responsibilities and authorities of personnel, including the quality manager. If they say a role can, it can. Little that can be done. This does not mean it is bad per se. Sometimes having 'admin' rights to skip/force stuff keeps the company working till the system catches up.
As for customer approved deviation waiver; I think it is a good option to have. But its risks should be managed. Not just the risks at the standard and the requirement level mentioned above.
Also assess whether such a waiver could result in reputation damage. Because one customer might find certain things acceptable/permissible doesn't mean others will. And others won't see the waiver, or necessarily the labeling that shows it is a custom deal. They will only see an in-market issue as problematic from their eyes.