The problem is that people will often grant that kind of access, particularly to pirate software. For example modification of hosts files (to prevent phoning ho

The problem is that people will often grant that kind of access, particularly to pirate software. For example modification of hosts files (to prevent phoning home) is generally something that lives in /etc which requires sudo to edit. OS X will refuse to run most unsigned software anwyay, unless you explicitly allow it. Though that could (should) be in parallel with some kind of sandboxing.