I don't have much experience in this area, but shouldn't that be prevented by the kernel unless IE got specific permission to do so?

...unless you're alluding to security exploits that manage to subvert that mechanism.

On Windows, any programs sharing a desktop are within the same security boundary and are not protected from each other by design.

But until running mostly apps becomes the norm in a desktop system beware that not having admin privileges doesn't not mean you can NOT: load programs at startup, read most of registry settings, passwords, read memory of/close programs of same sec level. A malware doesnt need admin rights to do evil.

Still I believe AV products are useless even for inexperienced users.

If you want apps to be blocked from touching each other, they need individual user accounts or equivalent. Operating systems for phones do this, but this kind of system hasn't been ported to a normal desktop.

I've checked, and current versions of MSE will detect this in time, but it's fast approaching the point where Windows will be running in a snapshotted VM with no network access.