What about creating different users on a MacOS system to do different things? Wouldn't this mitigate exploits like this? Why shouldn't I create a "Tommy Transc

What about creating different users on a MacOS system to do different things? Wouldn't this mitigate exploits like this? Why shouldn't I create a "Tommy Transcoder" user on my system? That user would have the Handbrake app in his own Application folder. I assume that Handbrake will run correctly without needing to be installed in the system /Applications? I already do this for a few items of software. Maybe it should be SOP to do this for most/all software? Or what about installing most apps into virtual machines and using VMWare to run them? I do recognize that such an approach couldn't be used universally. E.g. VMWare itself must run on the native machine, and with elevated privileges. I'm interested in "defense in depth". No single technique can defend against all possible exploits.