It definitely was not thought of from the start, no. We have already made significant improvements in the past few years in the security department, with NX bi

It definitely was not thought of from the start, no. We have already made significant improvements in the past few years in the security department, with NX bit (DEP), ASLR (including KASLR), W^X (kernel only for now), and SMAP/SMEP all now functional and enabled by default. However, there is still a long way to go. Not all syscalls do correct access checking (I started an audit here but I haven't finished it yet) and the GUI runs as uid 0 (you can run CLI apps and sign in via SSH as other users, though.) Slowly but surely...