OS X is specifically set up so that any such changes need explicit authorization just so no software can self execute itself I assume. But if people are willing to install anything that pops up.. then no amount of security will save them.
Like Windows doesn't have the same thing on it.
Actually, the implementation of DAC in Windows XP admin accounts, which is the default account created and the most used account type, does not provide this level of control to the user. Only a remote exploit is required to achieve system level access to install rootkits that bypass user space security mechanisms. Windows XP is still holds a majority of the global market share.
Newer version of Windows, such as Vista/7, have a high incidence rate of privilege escalation vulnerabilities that allow bypassing UAC. Many of these vulnerabilities have been used in exploits in the wild, such as
Tigger/Syzor and
Stuxnet. Generally, it is the Windows registry that provides a reliable vector to link local exploits to remote exploits.
Mac OS X does not have an example of this type of exploitation in malware in the wild neither does it have a system to store setting including settings for kernel space components that can be leveraged to gain privileges like the Windows registry.
The point is OSX now asks you if you want to run anything you've dowloaded off the Internet.
And, your point is ...? It also checks those items against a list in XProtect via File Quarantine to warn users about most of the known threats to OS X, much like AV software. Of course, like AV software this is not 100% effective. It is not a replacement for applying user knowledge.
As I've already pointed out, several programs (from Flash to Perian to Software Update and some others as well) ask for the admin password to install.
Perian, by default, installs only for the current user. It does not require authentication to install or update unless it is installed for all users.
As of Snow Leopard, most updates do not require authentication if you install every update soon after it is available. This is because the updates through Software Update are code signed. Software Update makes it very easy to stay up to date in this manner.
All it takes is one web site hack to a well known app to go unnoticed for a few weeks and even the smartest user could be fooled into installing a trojan.
Most installers and updaters, including the Sparkle framework used by most third party software for Macs, verify MD5 checksums before completing an installation or update. The specific purpose of MD5 checksum verification is to prevent this type of attack.