Sandboxing. All third party apps in the Mac app store, and many system apps. Safari, Mail, Messages, FaceTime, Calendar, Contacts, Photos, Notes, and Reminders are all sandboxed.

I also really like how Gatekeeper ( https://en.wikipedia.org/wiki/Gatekeeper_(macOS) ) works – it quarantines documents such as word files, so that on first open you get a dialog pointing out that it's been downloaded. This is great, because you see the dialog very infrequently. I actually pay attention to it when it comes up.