It's not so much the "applications can write data to application data" as it is "application data is executable by default". It's simply a design choice from before security was important. Nobody would defend that design today and Microsoft recognized this when they created appx which separates installers, executable programs, and data into separate content types treated with separate security policy.