Hmm I feel like this could work but we (SWE professionals) would need to provide a secondary private API surface that assumes the user is hostile. IE if you want to automate something that interacts with any private software it’d have to be treated like an adversary.

I guess in the long run it could become worthwhile, but it’ll be a long road to get there