MAC addresses your later concerns. The fact Arch does not support MAC at all then becomes somewhat of a problem, but it is already a huge problem to begin with.

MAC addresses your later concerns. The fact Arch does not support MAC at all then becomes somewhat of a problem, but it is already a huge problem to begin with. You can simply make SELinux / Apparmor profiles that default-restrict applications to ~/.config/<appname> and ~/.local/share/<appname> with quotas. Applications that need exceptions would be shipped with apparmor or selinux profile files to amend that. Its also how you can make desktop Linux a lot more sophisticated in permissions management for applications. I know Apparmor at least supports the idea of network, peripheral, and display access in the same way it controls directory access. It would be a huge usability and security boon to the Linux desktop to have notifications of requests to access resources when an application does so - I think Android 6 is absolutely going in the right direction on application control, and adopting those ideas would be valuable.