There are in-between models, such as:

* Android's permissions model where the user must approve specific potentially undesirable classes of actions (separate from the 24H delay, etc controversy)

* Optional sandboxing