what if one user in WPMU change the theme files?

Themes

All
themes are installed for the entire network. If you edit the code of
one theme, you edit it for all sites using that theme. You can install
the plugin WordPress.com
Custom CSS to allow each site to tweak their own CSS without
affecting anyone else. You can activate themes for the entire network,
or edit sites and activate them individually.

https://codex.wordpress.org/Multisite_Network_Administration

But “users” don’t get to edit themes in Multisite. Only the Super Admin (Network Admin) can do that.

Additional Admin
Capabilities

Only Administrators of single site
installations have the following capabilities. In Multisite, only the
Super Admin has these abilities:

  • update_core
  • update_plugins
  • update_themes
  • install_plugins
  • install_themes
  • delete_themes
  • delete_plugins
  • edit_plugins
  • edit_themes
  • edit_files
  • edit_users
  • add_users
  • create_users
  • delete_users
  • unfiltered_html

https://codex.wordpress.org/Roles_and_Capabilities#Additional_Admin_Capabilities