@DanRosenstark - probably - I haven't researched the Mac App Store restrictions.
I wonder, however, if there are any security holes that can be caused not by malware stealing focus, but by malware interacting with the user, so that the user is pointing and clicking, and then the malware doing something, like an error, that causes 'legitimate' SW to steal focus, so that the user input events go to the legitimate SW - and cause it to do something that the user probably does not want it to do.
This certainly applies if the 'legitimate' focus stealer puts up a box with "Delete" or "Are you sure?" buttons. Worse if the async legit SW asks for a program to run, or presents something like finder with program icons to click on.
It's hard for malware to control this - but malware is smart.
Heck, I am sure that this is a vulnerability.
Focus stealing, by anyone, whether malware or goodware, is a security risk.
The only really secure thing if you really, really, need the user to stop typing or mousing at his current app and pay attention, e.g. to an error, is to put up a dialog box with an error message, gray everything else, after a while beep or otherwise warn if there is any input anywhere else, but not to accept input into the new dialog box until the user has done something explicit to get there.
Not just click on a button in the dialog box, because the mouse may already have been positioned where it pops up. But some unlikely to be accidental thing, like moving the mouse around (like a big circular gesture), and then clicking.
(It does not have to be so onerous if the error button is someplace where the user would not normally have his mouse. E.g. display an error message that might say "You need to go to the notification error to cancel this")
Focus stealing is a security hole, no matter who steals the focus, if whatever the user may be doing, wherever on the display, pointing, clicking, typing, touching, possibly with head down not looking at the visual feedback, may be misdirected.