Earlier quoted context omitted.
I'm not sure the "big problem" of Windows stemmed exactly from possibility to install third-party apps, and not from poor security defaults which let those apps to mangle everything around without asking for permission, and poor architectural decisions which let some programs to install themselves (aka viruses). Nowadays Windows is much better with this staff than it's used to be, in spite of the fact that (contrary…
To be fair, Linux and friends aren't much better in that regard. Permission management for locally running programs is pretty much poor by default in all major operating systems. SELinux and AppArmor for Linux improve on the situation, but they're usually not the default unless you're using Fedora, and even there, it might need some extra configuration. I'm looking forward to capability-based systems with microkernel…
Linux gets there a different way. The standard way to install applications is from the package manager and essentially all of the applications in there are trustworthy (because they're all open source and if they did anything seriously user-hostile, someone would fork it and that version would be the one in the package manager). Meanwhile the package managers do actually add nearly everything that isn't user-hostile, so the need to install anything from another source, while still possible, is rare enough that most people never have to do it.
And binaries downloaded via web browser don't even have the execute bit set by default. You can still do it, but you have to know how, and the people who know enough to know how to do it generally know enough to be suspicious when doing it.
And even then, things typically run as the user rather than root/administrator, so they can't alter the system or anything other than that one user's (presumably backed up) home directory.
Having even more granular permission would be even better, but restricting the harm to one home directory of one user and only in cases of users who are at the same time knowledgeable and stupid has already handled basically the entire problem.