There's Gatekeeper, that warns people about unsigned software from untrusted sources, and prevents it from running by default (you have to know to ctrl-click the app to force it to open, which really cuts down on accidental installs and saves most technically illiterate users from themselves).
There's also SIP, which makes sure that even if malware is installed, it can't mess with a large number of system-owned files, so the amount of damage it can do is somewhat curtailed.
There's Gatekeeper, that warns people about unsigned software from untrusted sources, and prevents it from running by default (you have to know to ctrl-click the app to force it to open, which really cuts down on accidental installs and saves most technically illiterate users from themselves).
There's also SIP, which makes sure that even if malware is installed, it can't mess with a large number of system-owned files, so the amount of damage it can do is somewhat curtailed.