Linux security is technically quite advanced. Namespaces and seccomp-bpf have no parallels in Mac OS land that I'm aware of. It is true that most programs are installed systemwide with no form of sandboxing beyond the usual Unix access controls, but that is starting to change with projects like Flatpak and Snap, which attempt to build a general purpose app sandboxing framework using said security primitives.