ICE works because most users don’t install programs.
For most people, the computer is either comes with pre-installed software or someone sets it up for them.
After it’s set up, they just use it. They send emails, write blog posts, read social media, manage their checkbooks, and so on.
The problem is that there are companies and bad people who will lie, hide and cheat to get their program running on this otherwise clean machine.
So, we block programs from getting written to the hard drive so it can’t run.