SystemUpdate() inside my remote event receive will raise "Access denied. You do not have permission to perform this action or access this resource."

Question

I have the following code inside my remote event receiver (which run on item added):-

 using (ClientContext context = TokenHelper.CreateRemoteEventReceiverClientContext(properties))
            {
              currentItem["OrderAssignToApprover2"] = new FieldUserValue() { LookupId = spUser.Id };
              currentItem.SystemUpdate();

now if a non-admin user add an item then the remote event receiver will raise this error on the SystemUpdate():-

Access denied. You do not have permission to perform this action or access this resource.

but if admin user add an item then the remote event receiver will works fine OR if i change the remote event reicever to run using App Permsion, as follow:-

using (ClientContext context = Helpers.GetAppOnlyContext(properties.ItemEventProperties.WebUrl))
            {
              currentItem["OrderAssignToApprover2"] = new FieldUserValue() { LookupId = spUser.Id };
              currentItem.SystemUpdate();

so can i assume that the SystemUpdate() (unlike Update()) require the user to have full control on the site?If this is the case then is there a way to allow non-admin users to execute SystemUpdate()? Thanks