They tried. UWP and the Windows Store did loads to boost security and make the source of apps verifiable, but people hated it and barely used it, so the holes they were supposed to patch stayed open. The store itself did have the problem that part of its raison d’être was to try and take a cut of the sales of all software for Windows, like Apple do for iOS, and UWP made certain things a pain or impossible (sometimes because they were inherently insecure), but UWP wasn’t tied to the store and did improve even though it’s barely used.

executable as a filesystem attribute

This already exists. It’s labeled as “Traverse folder / execute file” in the UI.

NTFS permissions are also more powerful than the default Linux permission system. Instead of just being able to define permissions for a single user and single group, you can define them for an arbitrary number of users and groups.

I say “default Linux permission system” because you can actually use ACLs on Linux (getfacl and setfacl commands), they’re just not used by default. They used to be common in businesses and schools, but these days everyone seems to store their files “in the cloud” and the permissions are managed there instead.

curated app repos

This is what the Windows store is supposed to be. There’s also WinGet, but I’m not sure if it’s curated.

Yes. The question comes down to how many of these you need. And do you have the resources for it?