a locked down machine that lets code run from places users can write? how pointless
You can do similar things on Linux as well, but there it is easy to fix by setting `noexec` on /home.
(a) doesn't have a Web browser, or
(b) has some way to ensure the code it's running is not from a site where the user wrote all (or even just some) of it