The isolate utility

It even helps for deliberate ones, for a lot of attacks are based on races in file access. By locking a non-root process in a directory where it has absolutely no rights for (except for 'execute') helps limit the possible attack angles a lot by allowing less direct interactions with your environment.

Security is the sum of it's parts and no matter how evil you are, you still must exploit a weakness and anything that limits the possible weaknesses (even if it's one less) helps.

So this does help against evil even though it's not an end-all solution.