It'd need to be vertically integrated from OS to user space apps, and restricting what can be installed.

I'm not sure to understand the proposed solution here, but it seems someone could just use a different web browser client who don't inherit these restrictions.