It's a start for sure but there is so much low hanging fruit here. Eg a warning/prompt if a program tries to read/modify/delete more than x files in your home

It's a start for sure but there is so much low hanging fruit here. Eg a warning/prompt if a program tries to read/modify/delete more than x files in your home directory (not including its own config files). This would stop an entire class of malware scanning for passwords or secrets in your home folder. It could even if implemented right stop some of the ransomware attacks after a few files. It seems crazy that so little effort is put into this kind of thing vs the crazy level of effort that goes into hardening the OS.