Something can be worse than nothing when it tricks users into thinking it provides meanigful security guarentees.

You're better off relying on OS-level security mechanisms. Not only is it more likely to be much safer/secure, but it also means you don't have to worry about compatibility, missing features, etc. when you switch runtimes/software stacks.

Node actually took that from Deno, they do have a permission model now: https://nodejs.org/api/permissions.html