I think consumers don't give Apple enough credit for securing their OS because the other consumer-grade OS we compare it to was such a malware-magnet for decade

I think consumers don't give Apple enough credit for securing their OS because the other consumer-grade OS we compare it to was such a malware-magnet for decades that we've set our expectations low. Several of the latest OSX releases have progressively locked down some executables/directories to Ring -1 (requires more than just root/sudo privs). I see it as Apple locking down the OS against potential malware, as I've always been able to work around their changes with some Stack-Overflow-fu.