UAC is not a security boundary. Malware can bypass it if it wants.

It helps to actually enable having to type a password instead of clicking on Yes.

However yes, security is much more than an UAC dialog.