That's definitely a big part of the issue - the idea that your local machine is a secure environment and that attacks from the inside are not as heavily defended against as attacks from outside via the network.

Agents turn that assumption on its head. It's not only default allow vs. deny, but also the design of many tools. E.g. the Linux utility `ls` has an `-exec` option which can execute a binary, which turns a tool that really should be a read-only directory inspection tool into something that can execute arbitrary code. That makes it unsafe to authorize agents to always be able to use `ls`, unless they're running in a tightly controlled sandbox.

All OSes are full of these kinds of traps, because it wasn't something people were paying much attention previously.