This should be the default.

On Linux, packages should provide the SELiunx (or whatever) rules they need, and the user should accept them or not install the package (just like permissions on Android/iOS apps).

On Windows, the application could be sandboxed to its folder in `Program Files` and `%APPDATA%`.

Being secure by default should be the norm. When its not, you can tell users "you should do this" all you want, they won't do it.