There are functions EnumWindows() and EnumChildWindows() specifically for this purpose.
See utilities "Windows Modifier v2.00" (when I first downloaded it there were many pages about it, but it's a sign of how forgetful the Internet has become that I barely get any results about it now even searching for that exact name) and Microsoft's own Spy++ (SPYXX.EXE) for an example of this functionality.
The solution to an app you don't trust is to not use it at all, or use it in a VM.
A solution is to not use third party apps but most people aren't going to go that route. The VM idea is a good option though.
Because this architecture predates the existence of the current privacy nightmare.
In fact it predates the general availability of the internet. How could a program you would install from a floppy/compact disk bought on a store behave maliciously if you didn’t or barely had access to the internet ?
And then it stayed like this because Windows is heavily marketed as being retro compatible.