IMO the solution is to give users the tools to run apps in a sandbox without forcing them to or making it the default. If an operating system like macos were to

IMO the solution is to give users the tools to run apps in a sandbox without forcing them to or making it the default. If an operating system like macos were to ship with a user-friendly UI to change what a given app has access to, then even relatively non-technical users might decide to e.g. turn off WhatsApp's access to various things if they happen to read a news article about the app's data collection. In addition if an OS provides a way for sandbox settings of apps to be changed, then something like "ublock origin for the OS" could be created, where someone maintains a list of what capabilities should be granted to various apps, and users can just install something once and forget about it to harden their system. Most users trust most of the apps installed on their computer, but might have a few things that they are suspicious of — such as things they have to install for school or work. Providing a way for users to restrict the capabilities of specific apps when they feel like they need it could be valuable. Linux already effectively has this because it has stuff like user namespaces and better support for controlling other processes using ptrace than other OSes. This enables users to use things like proot and bubblewrap to apply sandboxing when needed.