Yes, this is more or less sandboxing. The fact that a freshly downloaded binary has r/w access to all of my files should be considered a vulnerability nowadays.

Yes, this is more or less sandboxing. The fact that a freshly downloaded binary has r/w access to all of my files should be considered a vulnerability nowadays. The macOS approach, in which a binary only gets access to files that are explicitly selected through the OS’s file chooser, is a good first step. The downside is that it can get very annoying for the user. An ideal solution for desktop machines still doesn’t quite exist.