The problem is that for some significant amount of users, they don't have the mental model to differentiate between running stuff in an Administrator prompt and

The problem is that for some significant amount of users, they don't have the mental model to differentiate between running stuff in an Administrator prompt and playing about with their Word settings - one of them being dangerous and one of them not. We'd have to go right back to OS design principles in the first place to teach people that computers are not terrifying behemoths that are about to fall over at any given second, and then maybe that would follow through into our apps - but as it stands, they come with the default expectation that anything they do might result in needing to call IT. Funnily enough, ChromeOS gets that more-or-less right. There's barely anything you can do to a ChromeOS machine that makes it unusable, and nearly everything is ephemeral. Then you have the always-revertible settings in Google's web apps, and people love it.