To word the answer more precisely:
A SharePoint Farm Administrator has the ability to take and grant others the permissions to certain web applications and site collections but does not necessarily have the rights to content web applications and sites initially.
A user with User Policy for Web Application configured by the Farm Administrator for their account could be Denied Write, Denied All access or granted Full Read or Full Control to all site collections within the web application regardless of the points where granular permissions break the inheritance of access settings. Note that this is the only way to explicitly deny permissions.
A Site Collection administrator (Primary and Secondary owners) can be configured by a Farm Administrator. Such a user has Full Control within the owned site collection regardless of the points where granular permissions break the inheritance of access settings. Note that there can be other site collections within the same web application that this user would not necessarily have access to.
A user with Full Control granted only as being part of a Site Owners group or individually will be respecting the granular permissions below the point where Full Control was initially granted. So there could be sister sites and areas inside such a site where this guy would have no access at all or something other than Full Control.