Cryptolocker doesn't get root though - that's the point. Cryptolocker exploits the absurd situation that we protect system data better then we protect user data - the irreplaceable part of your computer.
ZFS protection on Linux is also an accident here - because on Solaris users can manage their own snapshots, but in ZoL you currently need root.
I've said it before: what people need is the concept of user privilege namespaces. So you sudo elevate yourself into 'backup' privileges without elevating to root.
The point is privilage separation and if you want to protect against root exploits then you need a separate machine with appropriate access control (which is basically an append-only backup).