When UAC was first introduced, most well-behaving applications were installed into Program Files folder, so any tampering with executable files without explicit user consent became impossible. So when a user executes a malware application, only this user's data could be destroyed.
However, a lot of applications are installed into AppData nowadays. Some applications want to make installation for restricted users possible, some applications don't want to ask for user consent every time they are autoupdated. Other apps ask for administrator rights during installation, put their files into Program Files, but change permissions of their folders.
- Google Chrome is installed into AppData. I've installed it into Program Files, but later found out it actually uses executable in the AppData folder.
- Valve Steam gives full access to SteamApps folder for all users during installation. This folder contains executables and data of all games managed by Steam.
Okay, Google Chrome doesn't seem to ask for admin rights, so if during its work it shows UAC dialog in yellow color, it'll be highly suspicious. But Steam games regularly ask for admin permissions when being run for the first time. Users will blindly say "Yes" to any dialog which appears during installation. And the result? The whole system for all users is compromised.
Applications like this seem to make UAC even weaker, even easier to bypass. Any executable file can change executable files used by all users. I guess PCs with multiple users with admin rights is insecure by design, but UAC provided at least some protection in this case.
How does this affect security and should I worry about it? If yes, can I do anything about it?