<i>&gt; Every model ever devised lets people run buggy programs.</i><p>There&#x27;s a big difference between:<p>(1) A user being able to run buggy programs <i>if</i> someone is able to hack the secure distribution chain or <i>if</i> someone is able to get the user to give root permissions (or any permissions other than those of their ordinary user account) to a piece of malware;<p>and<p>(2) A user being able to run buggy programs because the default app model on their system dumps all app binaries into their ordinary user account&#x27;s data area, with that user having write access to all the files, so any random piece of malware running as that user can hose them.