I would expect the OS to be checked for safety before an attempt to install it in a place it had access to infect other machines. Anyone with the ability to ins

I would expect the OS to be checked for safety before an attempt to install it in a place it had access to infect other machines. Anyone with the ability to install an alternate OS working in such an environment should have the knowledge to not do something that stupid. The fault here is with the person, not the software. Protecting users from themselves so much that they have no control of the software on their machines as an alternative to your scenario seems like giving up too much.