On one hand, there are things that no user can do, such as
- hard-linking directories (because of file system limitations)
- writing to an already burned CD-ROM (because physics)
But those are not privileges, because they cannot be granted, they are just not possible for anyone.
Then there are restrictions for the entire system or parts of it that can be turned on or off.
For example, on OS X there is an option to only allow code to run if it has been signed by Apple.
I don't consider this an actual privilege either, because no user can have it if the superuser can't. You can only globally disable it.
Your idea of a file without the executable bit would also fall in this category, as literally, no one is able to do that, and no one can be granted that permission.
And even when giving another user or group the permission to execute that file, but not root or a user group root is in, root will still be able to execute that file (tested on OS X 10.10, 10.11, and Ubuntu 15.04 server).
Apart from those cases, there is barely anything root cannot do.
There is, however, a thing called kernel mode (as opposed to user mode).
As far as I know, on a sane system only the kernel, kernel extensions, and drivers run in kernel mode, and everything else (including the shell from which you log in as root) runs in user mode.
You could therefore argue that "being root is not enough". However, on most systems the root user is able to load kernel modules, which will in turn run in kernel mode, effectively giving root a way of running code in kernel mode.
There are systems, however, (like iOS) where this is not (arbitrarily) possible, at least not without exploiting security holes. This is mostly due to increased security, like code signing enforcement.
For example, there are AES encryption keys built into the processors of iDevices, which can only be accessed from kernel mode. Kernel modules could access those, but the code in those kernel modules would also have to be signed by Apple in order for the kernel to accept them.
On OS X, since version 10.11 (El Capitan) there is also a so-called "rootless mode" (although the name is misleading because root still exists), which effectively forbids root certain things that installers can still do.
Quoting from this excellent answer on AskDifferent:
Here's what it restricts, even from root:
- You can't modify anything in
/usr/local); or any of the built-in apps and utilities. Only Installer and software update can modify these areas, and even they only do it when installing Apple-signed packages.