What you say is true, however I am afraid permissions are not the solution either. Look at android ecosystem - they have tons of permissions, but who actually looks at them? People just click "accept" 99.9% of the time. Same will be on desktop OSes. Granted, more granular permissions make Android somewhat safer - but it also makes many things harder to do. If you did this on desktop, users would scream and demand to make it "convenient" - which would lead to them clicking "accept" where they shouldn't.
The problem is it's very hard to distinguish legit from non-legit without asking the user. Users do a lot of stuff and malware can mimick any of it. And if you do ask the user, the malware can make the user answer yes - usually by means as simple as "The OS will be displaying a confirmation dialog, please click YES for this program to work". Yes, it won't work with 100% of people, but it's a game of numbers - it will work for significant number of them.
