Qubes OS does a much better job though, because it relies on security through compartmentalization, not security through correctness.
> assuming you didn't set a 20 random character password
It doesn't have to be all random characters for good protection.