[0] The permissions-grating mechanism needs work, but the base concept is sound.
With 'profile' I assume you mean combination of registry and home directory, so Windows has the registry going against it but as far as the home directory is concerned it's the same thing everywhere. Aren't most OS plagued by that, and is it in some way also not logcial? Some software must store things. So if you want to install software for one user (like the ~/Library you mention) and have per-user configuration, and so on, all of that ends up in the user directory. And I don't think there's any OS which manages to go from a full install to a clean install and can clean up the home directory while doing so. Instead leaving a myriad of subdirectories of which it isn't immediately clear whether it's ok to just delete them or not.
If the app needs access to folders it asks for it (even ~/downloads) otherwise it has nothing by default.
NixOS ;)
I then realised that having actual isolation was never even a goal of the project, so I've never bothered to look at Nixos after that.
The only project on Linux that provides a practical solution to this is Qubes OS. I use it, but there are limitations that prevents it from being used by a lot of people. The fact that applications don't have GPU support is a big one.
One may suggest Flatpak as well, and it's a good solution when using properly packaged software, but if I want to do development and use various tools without necessarily trusting all of them, Qubes OS is really the only way I can do that.
Except if the vendor wants to have the ultimate control over access to my machine.
It's like buying a house and leaving a copy of the key with the bank.
Windows ecosystem is much worse, terribly so: a lot of existing and new installers still require running with elevated privileges for no good reason, oftentimes simply because of the installer framework used, despite being signed by whoever or not, and I keep seeing the UAC prompt way more often than I should. I tend to not use software requiring elevated privileges to install at all --- for example, nearly all "top" vendors of commerical-grade PDF editing software just recently have not gotten my business, simply because their installers --- executed in a VM to test the software --- all required elevated privileges, were very invasive to boot and didn't uninstall cleanly. I also enabled Controlled Folder Access on all my personal data directories -- o boy, you wouldn't believe where shitty software wants to put its hands.
As far as I am concerned, most vendored software of Windows is malware by behaviour, to some degree. It wants to run unconstrained and infests the user profile almost irrecoverably save a fresh install. I recommend all users of Windows enable controlled folder access on any volumes / folders that old personal data...