It also apllies some security practices by default, like not executable by default, mime type detection of files (no document.pdf.exe), which does make a linux desktop more safe.

And safety is always a compromise with practicability. For example, Linux-hardened.

But sure, there's always room for improvement.