I personally like where macOS is going: immutable base OS tree, accessing user content folders requiring per-application approval (wish I could also just grant per-application read or write access). I am personally a power-user of macOS, compiling a lot of software myself or via macports, and as long as these tools work without requiring root access, narrowing down what any process can do to the bare minimum has my approval. In fact installing software for single account use shouldn't ever have to require elevated privileges at all. Even the model of .app bundles is user friendly in that regard in that any user can install apps under ~/Library instead of installing them system-wide. I'm attempting to do the same on any and all Linux servers I run, using systemd's + selinux's isolation features to constrain any long-running processes as much as possible.
Windows ecosystem is much worse, terribly so: a lot of existing and new installers still require running with elevated privileges for no good reason, oftentimes simply because of the installer framework used, despite being signed by whoever or not, and I keep seeing the UAC prompt way more often than I should. I tend to not use software requiring elevated privileges to install at all --- for example, nearly all "top" vendors of commerical-grade PDF editing software just recently have not gotten my business, simply because their installers --- executed in a VM to test the software --- all required elevated privileges, were very invasive to boot and didn't uninstall cleanly. I also enabled Controlled Folder Access on all my personal data directories -- o boy, you wouldn't believe where shitty software wants to put its hands.
As far as I am concerned, most vendored software of Windows is malware by behaviour, to some degree. It wants to run unconstrained and infests the user profile almost irrecoverably save a fresh install. I recommend all users of Windows enable controlled folder access on any volumes / folders that old personal data...
Windows ecosystem is much worse, terribly so: a lot of existing and new installers still require running with elevated privileges for no good reason, oftentimes simply because of the installer framework used, despite being signed by whoever or not, and I keep seeing the UAC prompt way more often than I should. I tend to not use software requiring elevated privileges to install at all --- for example, nearly all "top" vendors of commerical-grade PDF editing software just recently have not gotten my business, simply because their installers --- executed in a VM to test the software --- all required elevated privileges, were very invasive to boot and didn't uninstall cleanly. I also enabled Controlled Folder Access on all my personal data directories -- o boy, you wouldn't believe where shitty software wants to put its hands.
As far as I am concerned, most vendored software of Windows is malware by behaviour, to some degree. It wants to run unconstrained and infests the user profile almost irrecoverably save a fresh install. I recommend all users of Windows enable controlled folder access on any volumes / folders that old personal data...