I definitely didn't intend to blame the victims here, beyond trusting Meta in the first place.

As for security models, it's probably long since time to sandbox all data and apps. More like mobile devices. Allow users to toggle that all off so they can use their computers for development etc, but the default state should force apps/tools to explicitly ask for permission to any folder, other app, API, CLI, etc. And ask for that permission regularly (or rather, reset the permission after some period of time). Or something like that (I haven't given it a great amount of thought).

there are patterns like task-scoped authorization solutions that could help here but the integration would be tricky since Muse is not open source