This is about protecting user files and areas, not the system files. A user level ransomware can indeed encrypt all /home/$user contents on macOS just as easily

This is about protecting user files and areas, not the system files. A user level ransomware can indeed encrypt all /home/$user contents on macOS just as easily as it can C:\Users\$user on Windows.