MacOS has app sandboxing. It's just linux and windows (and freebsd) that suck at it.