metro style apps run in something called an appcontainer to prevent them from interacting with other applications on the system.  And I'm sure that all metro style applications will have to enable safe SEH and ASLR to improve their resiliency to threats.  But the appcontainer isn't about stopping malware.  It's about helping ensure that windows 8 end-users won't ever regret installing an application.