> For instance a simplistic image viewer which opens internet connections and fetches data from the net ... that sounds weird, right?

It's interesting that this specific example would've also been caught with a sandbox and permission system. The surface covered between antimalware and sandbox/permssions aren't entirely the same but there's a lot that is shared.

Unpopular opinion perhaps, but I think desktop operating systems need to start including robust sandboxing and permission systems that are turned on by default. We've grown accustomed to desktop apps implicitly having access to everything, but if you think about it it's actually a bit strange that an app can just reach out and use your network, camera, etc as it pleases.