Still talking about default config here
On Linux, the default config is you install most programs from the "trusted" distribution's repositories. Flatpaks and Snaps are increasingly used for apps that are not in the repository. They are not perfect, but they are improving.
I don't know how it works for macOS. You'd download a program image but I don't know what the program can do and if there's a sandbox.