Operating systems do not have a concept of "safe". They have a concept of "permitted", and somebody decided what that means.
The model
On a Unix-like system every process runs as a user, and every file has an owner, a group and a set of bits saying what each may do. That is nearly the whole model. Its simplicity is why it has lasted and also why it is so often misconfigured.
- Root is not an administrator. Root is the absence of checks. The kernel stops asking questions.
- Permissions are checked on open, not on read. A process that opened a file before its permissions changed keeps its handle.
- Group membership is evaluated at login. Adding a user to a group does nothing until their next session.
Where this goes wrong in practice
The common failure is not a clever exploit. It is a directory left world-writable so that an application "just works", and then something in that directory being executed later.
drwxrwxrwx storage/That is a finding, every time. It says any process on the machine can place a file there, and something will eventually run it.
What to take away
When you audit a machine, look at what runs as root and ask why. Most services do not need it, and most of the ones that do only need it to open a port below 1024.