Indeed, OSes already have privilege access mechanisms like GPO on Windows and SELinux / AppArmor / Flatpak on Linux to restrict installed binaries. Then all th

Indeed, OSes already have privilege access mechanisms like GPO on Windows and SELinux / AppArmor / Flatpak on Linux to restrict installed binaries. Then all that goes out the window when the 100 MiB gorilla named /usr/bin/browser wants access to everything anyway, connects all that privileged information to other people's computers, and then implements its own entirely separate privilege access mechanisms in userspace to make that secure.