Security’s dirty little secret: Not having your users logged in as root or administrator will not stop malware. Malicious hackers may not be able to modify System32 or sbin, but they can still intercept your identity and steal all your money. Microsoft is trying to encourage users and developers to go least privilege by introducing UAC (User Account Control) in Windows Vista. Many of the current malware programs that can do all the nasty things they want: modify your computer, steal your identity, whatever.”]
Source: https://www.csoonline.com/article/2633069/security-design–why-uac-will-not-work.html