Security Precautions, Local Installs, And Excessive Privileges.

Question

I have a few questions regarding security for my laptop.
First of all, any applications, plug-ins, etc., which are in the root level "Library" or "Applications" folder are allowed to run with admin privileges by default. There is absolutely no reason why this should be the case. Apparently, Apple decided to throw caution to the wind and assume no one would ever target a Mac for malicious purposes. How can I revoke admin status for these applications without moving them to another folder, where they wouldn't be easily accessible to every user account on the machine?
Secondly, the Installer program built into OSX is only capable of a "standard" install for every user and always demands root privileges before installing anything. How do I configure it to install only for the one user account it's running in, and without receiving admin or root privileges? If I get a program that's not drag and drop, I'm stuck manually ripping open installer packages and trying to extract the various components myself, which can be a bit of a pain. I would think there'd be some way of installing software that comes in an installer package without giving it root access; neglecting this feature creates a security hole of ridiculous proportions.
Thirdly, I'm not sure how many people have heard of Wowd, but it's a locally-installed facebook "app" of decidedly dubious origin, possibly involving an active trojan. Obviously, it came in an installer package. The Installer program, naturally, asked for an admin password to give Wowd root privileges. Installer wouldn't perform a local install without giving it root access, and the Wowd installer package was missing its "show package contents" item in the right-click menu. I was able to crack open the installer package with a program called Pacifist, and extract just the program; there was nothing else in the installer package, which seemed like it was just a ruse to convince people to give it root access by running through the Installer. Once the program was extracted and installed on a privilege-restricted account with nothing valuable on it, and deprived of admin access, I figured it was relatively safe-ish to run. Upon running, Wowd opened Safari; specifically, a Safari window pointed at http://localhost:8101/wowd/?tray on my local machine. While Firefox was sitting on the desktop of the restricted account, Safari was still sitting in the root level applications folder, which allowed it to run with admin privileges due to the bug described in point #1 above.
So, can any OSXperts here tell me whether Wowd was able to escalate itself to admin status through Safari and do who knows what to my machine? (Please do not inquire as to why I was playing with a live trojan.)
And can anyone tell me how to restrict admin privileges to the applications that really need them? The kind folks at the Genius Bar didn't have a clue how to accomplish this task, and were having trouble figuring out why I even wanted to.

Answer 1

First of all, any applications, plug-ins, etc., which are in the root level "Library" or
"Applications" folder are allowed to run with admin privileges by default
I'm not sure why you think so. Are you referring to the permissions on the /Applications folder itself, which are:
system - Read and Write
admin - Read and Write
everyone - Read only
These permissions mean only that an admin user can write to the /Applications folder (i.e. can save a file there), and that all users can read from the /Applications folder (i.e. can run apps from there). Those permissions don't say anything about the privileges that an application has when it is running.
Applications generally don't run with privileges of their own; they run with the privileges of the user account that is running them. For example, the permissions on the main /Library folder (HD>Library) are
system - Read and Write
admin - Read and Write
everyone - Read only
Now suppose you are running TextEdit from the main /Applications folder, and you create a textile and try to save it to /Library. Whether you can do it or not depends on the user account you are running from. Since members of the admin group can Read and Write to /Library, an admin user running TextEdit will be able to save a file there. A standard user, however, has only Read privileges to /Library, and so a standard user running TextEdit will not be allowed to save a file there. This is exactly as it should be. The write-permissions of the /Applications folder are irrelevant in this regard.