We just need a better sandboxing environment and individual permissions per excitable i.e. "Can this excitable connect to blah blah up?" , "can this program read outside of its sandbox folder?"

When you don't root your android or iPhone they handle it a lot better than desktop operating systems.