Well one thing they’ve done is ensure that all apps are sandboxed so that I can be sure when my mother downloads an app, it’s not going to be a vector to infest her computer.
Sandboxing is an excellent default, but the lack of permanent, specific exceptions when they're genuinely needed is what blocks whole categories of apps needlessly. (Your mother is probably not likely to download a pro FTP client.)
