macOS ships with a quite strong and granular capability-based security model with its sandboxing mechanism (at least, when it works and is applied correctly). The feature is there, advanced applications already make use of it, but it is difficult to get arbitrary applications to adopt it (its inner workings are declared SPI after all) and it is not really exposed to the user at all except via App Sandbox, which is fairly limiting.