Developers curl | bash all the time to install stuff without first checking that what they download is what they want. Why should we demand more care from less technical users?
The problem with the desktop security model is the controls are ridiculously course-grained.
it'd be really nice if it was more efficient to run an OS like https://www.qubes-os.org/. I think only true security model that works is the sandbox isolation model of virtual machines.