There's no fundamental technical reason why apps can't run as their own users (like apache and postgres have done for 20 years) and and use something like oauth to control sharing data with other apps. Just laziness.