I ... what? Huge swaths of the computing landscape depend entirely that model. Schools (from primary to academic research), Windows Active Directory workplaces, thousands of cheap VPS providers ... the list is very long. All of those contexts absolutely use user accounts on the same running OS kernel as a security boundary. I've seen more than a few academic and government worksites where effectively radioactive data owned by one user was on the physical machine that other users routinely used--just not in an account they could access. Those places' infosec history wasn't perfect, but not because of the insider-threat-on-shared-machine risk.

In cloud/webtech, I think it's easy to overlook just how many massive organizations rely on stuff like shared AD workstations, cheap user-based shared hosting, or shared HPC a la "every member of the university gets an account on the SLURM cluster and we slice compute allocations by account--and separate accounts prevent the new intern from seeing protected IP".

Like, malicious employees can attack such systems, yes. But with adequate mitigations (network partitioning, internet access control, auditing/telemetry, good SEIM, user data encryption where appropriate, patching...all the usual good practices) this is a perfectly viable security model. Not perfect, but nothing's perfectly secure and every security paradigm has tradeoffs.

Those environments aren't dinosaurs or asking for a security disaster; they've made considered risk assessments and decided that the multi-user-machine security model works for them.