Realistically, malware only affects a tiny fraction of users, and only a further tiny fraction suffer demonstrable loss from it.
For a certain generation of adults, going to visit your non-technical parents socially meant budgeting extra time to eradicate the adware of the month. It was a constant problem affecting large swaths of users, and fixing it was beyond the technical ability of most people.
Edited: fix typo.
Their whole design is incredibly neat and well done! If you like these features (or just don't care) the default install does make attacker's lives harder.
But if you disagree with these features or just don't like them you can just boot into recovery mode, authenticate with your password and disable almost everything for macOS.
And if you just like the hardware you can do the same and install a custom kernel like Linux or *BSD and do whatever you want.
You can even have triple boot into one macOS with full security enabled, another macOS install with everything disable and a third "macOS" which actually is Linux.
They spend a lot of effort and engineering time to make all this possible.
Its not a guise of security, it actually accomplishes it. Mac malware now has to operate within the confines of these permissions and nowadays the author has to submit a sample of the malware to Apple before it can be opened without insane prompts (this also means losing $99 and attaching their legal identity to the malware/committing identity fraud). If Apple went full-iOS on MacOS and made it so "everything must go through the App Store" then the possibility of mac malware would effectively disappear overnight into the same realm that iOS malware currently resides: jailbroken iOS devices with shady (mostly piracy-focused) apt repos.