Yes, I agree. But I don't think the path forward is to re-establish the security of root. Instead the path forward is to stop granting the full capabilities of the user to every program the user runs. In Android, for example, every app has its own user account. That is meaningful! I wish every desktop app were sandboxed by default, but it requires redesigning so many interfaces that you might as well think of it as a whole new platform.

Of course, such a platform basically exists: the web platform.

I think everything-is-a-web-site is the realistic way we get to secure desktops. I don't like it but it's hard to imagine anything else getting traction from here.