I believe the real problem is that devs install random binaries, or modules, without any real concern for what malicious activities, even if unintentional, these artifacts may perform. Forget the fact that it’s on the dev’s machine, they move this stuff into production without proper security vetting.
Many devs just blindly install things from npm, copy random snippets from GitHub gists, execute remote shell scripts via curl that they just copy and paste into the terminal because they read it in some blog post, and on and on.
Anyway, just my worthless < 2 cents.
Microsoft tried to push for a better model in the Windows Store apps. But the world reacted with apathy. Now they seem to try to leverage their built-in hypervisor instead, for example with Sandbox [1] for temporary VMs with minimal overhead.
1: https://docs.microsoft.com/en-us/windows/security/threat-pro...
I believe VMs are not just for security - it might be the only way to run completely different operating systems (like macos on linux, or linux on windows, etc)
Additionally, VMs might be a great help to complicated debugging. You can crash a VM without taking down your desktop. I'm not sure about things like kernel debugging, but it might be easier in a VM.
A better solution would be a desktop OS with proper application sandboxing. Mac OS is taking many steps in that direction.
Linux - as usual - has a multitude of solutions, all of them problematic. (AppArmor, SeLinux, Firejail, Snap, Flatpak)