>To limit what malicious software that runs as one's user can do, one must limit what the user can do

This is completely untrue. You can gain root access on Android and have full access to do anything while still keeping applications sandboxed. Limiting user freedoms is simply an extra thing that came with new mobile OSs.