When I run a program as my own user it can read anything from my hard drive. It can read my browsing history, look in my Documents folder where I keep important personal files, etc.
Contrast this to a web app, which has very strict default security settings implemented by my browser.
Why does this kind of sandboxing seem to be of major concern to my browser, but not my OS? What's the history that led to things being this way? Why is it still the case today?
Sandboxing is extremely hard to get right. It's even harder to retrofit it into an existing system, because so many programs exist that just store files wherever they feel like, and you don't want the new OS to break all the old programs. And if the OS provides a "legacy program" mode, malicious apps will just use that.
In addition to files, sandboxing has to protect against capturing screen pixels, getting keyboard events, doing network or device IO, inspecting the cut&paste buffer, and hundreds more things, all of which some apps have legitimate reasons to do. So the matrix of permissions gets very large.