That's exactly what UWP(universal windows platform) is - it sandboxes every app. But I am sure you will agree that having this as default behavior on windows would be disastrous, breaking compatibility with every app written before Windows 10, not to mention that the reason why we use PCs is to have low-level access to hardware, many applications require it and sandboxing isn't going to be a good option here. I guess MacOS way of doing things is a good in-between - by default, every app not from the app store is blocked, and you have to go through a slightly cumbersome process of unblocking it manually in security settings. I'm sure it beats the default windows permission popup, which I imagine 99% of users just accept without looking at, or disable outright.