Some people figured this out 40 years ago: Objects were supposed to be little (or big) virtual computers that communicated to each through message passing. Security (modulo side-channel attacks) is then just a function of each object's grammar and corresponding parser implementation.

We can then reason about security in terms of formal language theory. For example, an object's whose grammar is a regular expression is much more secure than an object with a Turing complete grammar.

Of course, if you take the idea of objects too seriously, you then realize that you don't need things like operating systems in the first place.