So their macbooks are insecure because they accept any package installed? Seems like a weak argument and an even weaker security model, has it worked ever security through obscurity/ black box? Should I avoid surfing through the web on non approved websites? Seems like they made a weak system security wise

It’s because it is actually a somewhat bullshit security model that basically boils down to checking what APIs are you using in your code.

The next generation of runtimes (wasm for example) have this built in out of the box.