Home folders and UAC have very little to do with the real-world security of Windows vs. other operating systems. The reality is, even today, if you get arbitrary code execution on any operating system you are probably boned.
The kernel is not some almighty bug free program. The question is then just whether or not the person who has gained the capacity to run code on your system knows an exploit that will give them root privileges.
The Android thing works because you aren't just running arbitrary code, you are probably running code that you got from the Android Marketplace, which was probably screened to make sure it doesn't do something bad.
How would they be screened? If you include native libraries in your APK, they're binaries, not code. They could scan the binary for API calls, but you're permitted to call dlopen() etc, so you could always hide a shared object in there and call it dynamically.
Okay, you can't screw up the whole system, but you can install a keylogger (X has got to be the most insecure windowing system out there), and you can use the system for a DDoS botnet.
Also if you use sudo or su in X, they now have root thanks to the keylogger.
And with threaded code attacks you don't even need to download an executable. You can run "script level" code by repurposing existing executable sequences.
