[AstralStorm]

Windows does what it can with SmartGuard. Users just click through it. You can enforce signed software plus whitelist if you want in a system policy. Just entertain the thought that now you will have to curate a lot of software on the machines.

You can disable execute for download directories too.

These are not the default because it annoys everyone to no end. Likewise installing applications just from Microsoft Store. (Where badness has slipped in too.)

And finally, people still get caught with an MS Office document which will be opened from a download just fine and with a fake website.