[bsharper]

The user can change anything they want, but a process launched by your user doesn't inherit every user access by default. You (the user) can give a process full disk access, or just access to your documents, or just access to your contacts, etc. It's maximizing user control, not minimizing it.

[eightysixfour]

I am talking about removing the ability to install kernel extensions.

As for full disk access, go try and remove Photo Booth from you Mac.