Most Windows malware I see today runs with the rights of the logged-on user. Encrypting file servers (at least portions thereof), exfiltrating data, and spreading via email are all easily accomplished with the rights available to a normal user. Without a privilege escalation exploit the attacker probably can't install a driver or spread to other user sessions on the same machine, but everything accessible to the logged-on user is accessible to the malware.

Without a capabilities-based security model I don't see what good the "for security" changes in Windows 11 really bring to the table for end user security. Capabilities-based security would be a major breaking change for legacy software anyway. More than likely, would just result in IT departments granting all capabilities to all legacy software.

The Windows 11 "security" seems more about removing general purpose computing access for "tinkering" end users to enable more draconian DRM, walled-garden type business models, etc.