Same thing with Java Security Manager which is in the process of being removed with no replacement.
Unfortunately supply chain security is incompatible with developer convenience. At least not without a lot of work to make it bearable.
We will have to suffer through a lot worse attacks than now before people will take it serious (most developers likely never but governments will at some point intervene - see EU's CSA).
Even at the language VM level, it doesn't seem to be tenable.
Microsoft tried to go all out on this back in the day with Code Access Security. I remember three things about it:
1. Engineers/sysadmins would easily get frustrated, and just let the app run under full trust
2. Perf issues, since security demands would result in checking the call stack up
3. When they changed things in .NET 4 a lot of web code would break unless you added a magical attribute.
Needless to say, microsoft more or less gave up on it in .NET core