You can do similar things on Linux as well, but there it is easy to fix by setting `noexec` on /home.
(a) doesn't have a Web browser, or
(b) has some way to ensure the code it's running is not from a site where the user wrote all (or even just some) of it