Exactly, for normies who're looking to purchase a Mac the default options *will* be only allowing the user to downlaod apps off the App Store and not allowing them to easily gain permission to grant third parties powerful choices. But for power users, the option to disable all of those will always be available on the Mac.Kernel extensions do represent a significant security risk. They should be difficult to install, I would not want any of my family members to be able to install one.