Its true that there are holes and that UAC isn't a particularly strong security barrier (i.e. If an attacker is at the keyboard it won't do shit). But that's th

Its true that there are holes and that UAC isn't a particularly strong security barrier (i.e. If an attacker is at the keyboard it won't do shit). But that's the same for OS x and they have some even worse patterns; e.g. I'm pretty sure half the installers I end up using take your password themselves and pass it on to some waiting sudo under the hood. They at the very least don't use the proper system way of doing things; i can tell because some things trigger touch id and some don't. Similarly, there have been many stories about dropbox circumventing system security. I have no doubt that if dropbox can figure it out, malware writers can, too.