I completely agree, I was merely refuting the authors point. Not stating that security does or does not rely on ACL's.
The recent malware entirely (as I understood) depended on the user putting their password into an OS prompt for permissions for the bad program. How can the OS make the line between that and something safe like Growl or Virtualbox?
Stating the obvious: App Store only software installs, and other DRM solutions. And yes, that has a price that people may or may not be willing to pay.
It's somewhat scary, but I'm starting to think that we will be forced to adopt something like that. Computers are used for serious stuff too (payments, medicine, things like that), and, apparently, way too many people can't be trusted to administer their computers securely. Right now people are mostly damaging own life, but if this starts happening to medical records, it's going to go beyond personal security.
It's too bad, really. Even if "developer programs" were free -- i.e., just required asking the corp for a developer key (this could be enforced on state level), it would be more of a hassle than it should be.
If the user is able to escalate his privileges (whether with UAC or sudo, the OS doesn't matter) in order to install malware then he loses.