Are people not taking this as a default stance? Your mental model for this on security can’t be

“it’s going to obey rules that are are enforced as conventions but not restrictions”

Which is what you’re doing if you expect it to respect guidelines in a config.

You need to treat it, in some respects, as someone you’re letting have an account on your computer so they can work off of it as well.