That is the way it is. . . but with the warnings the built in Gatekeeper system Apple includes with OS X, and the warnings a user would have to ignore to install a Trojan, it really takes "industrial strength stupid" to get infected on a Mac. They literally have to not just ignore three System Alerts, but to put in an Administrator's Name and Password to proceed three times to download, install, and finally, run, an application containing a Trojan. As you said, ". . .doing something they shouldn't."
Make sure you have your Mac's Gatekeeper system under System Preferences/Security & Privacy/General set to download only from "Mac App Store and identified developers." You can, on occasion, change that to download something you KNOW ABSOLUTELY IS SAFE, by clicking Anywhere, doing the download, and then putting it back to "Mac App Store and identified developers." If you do that, DO NOT IGNORE ANY WARNINGS THE SYSTEM MAY SHOW YOU ABOUT WHAT YOU ARE DOWNLOADING!!!
In the meantime, Gatekeeper wil scan any thing downloaded from an email link, brought in on a disk, or other source, and also do the same thing for anything being run for the first time.
You are running as a standard user, not as an administrator user, right? If not, or you don't know how to check, (this is not just for you) let me know and I will post steps on how to check, and also on how to change the user type.
I m running as a standard user. Thanks for all the additional info.