Your point of view has an insidious lie at its core; that the user perfectly knows what she wants. That if we only give the user the ability to set capabilities, we will not need any other protection for her.

The reality is that we're water meatballs, we're so easy to fool, and we need the cold calculating power of code to protect us from ourselves.