I think the problem with this logic is that you're thinking about filenames and not credentials. There's one place to go to cripple a Windows box (a parallel filesystem), and there's one set of credentials you need to cripple a Unix box (the capability to write /etc, or /usr/share, or /usr/local/mysql, or ~/Library, or...).

I admit to not knowing how the Windows registry's various parts are protected. But individual files/directories can be protected separately on Unix-like systems (whether they are is another question).

If the Unix root user is not enabled, especially for remote access, and assuming you don't have access to the physical device, then it's a question of which Unix accounts and groups you do have access to. Also, technically directory write permission is all that's needed to compromise a Unix file, so all files in the same directory are equally vulnerable. (Even this assumes base permissions and not ACLs, etc.)

First, taking OSX as an example desktop Unix (desktop Linux has the same problem), if you own my UID, you also own my ~/Library, and thus my account and arbitrary code execution under my credentials.

Second, the registry is privileged the same way; write access to one part of the registry doesn't give you write access to all of it.

Third, it is notoriously hard to keep permissions straight on configuration files, especially when you're trying to manage multiple roles (for MySQL, qmail, and root, for instance). So most people screw it up.

But I mean, I don't think this is a huge problem. I just think I can knock down a lot of arguments about how the Win32 registry is an abomination. There's a lot not to like about it, but it isn't crazy.