The underlying idea of the comic is that separation of user accounts has been designed for mainframes: big computers, shared by many users. In that model, the potential attackers are other users. Account separation is then about protecting users from other users; only the god-like admin account can access everything on the machine, and the administrator has the duty of using his powers to strike down users who try to escape the boundaries of their accounts. System administrators consistently love this model, if only for its inherent ego flattering effect.
However, personal computers are not handled like that. They have a single user who expects to have admin powers on his system. More importantly, the attackers and defenders have changed. The attackers are now remote entities -- non-users from the outside, who will try to enter the machine through various vulnerabilities, in the loose sense of the term (this includes virus on USB keys, hostile scripts on Web pages, remote holes in network stacks...). The assets which the user tries to defend mostly reduce to their "elements of online identities", in particular the set of browser cookies, and their natural extension, the passwords typed by the user.
The comic points out, in a graphical way, that a separate administrator account does absolutely nothing to protect these assets. It does not harm, but it has no added value.
What should OS do ? Actually, not much -- it's more a question of what Web browsers should do. Increasingly, the Web browser is the operating system, and what we think of as the OS might have to be renamed "collection of hardware drivers". That's the idea which, for instance, Chrome OS tries to fully explore.
Account separation in mainframes was a damage containment feature. Its purpose is to prevent propagation of evil, and allow the sysadmin to smite at the infidels and trample them into oblivion, namely suppression of account. The gangrenous limb is not saved, but it is severed so that the rest of the organism remains safe, to some extent. How does this translate to the way personal computers are really used ? Remember that what is to protect is, primarily, the set of browser cookies. Damage containment then calls for domain-based sandboxing.
Indeed, cookies are already domain-separated: a server from a given domain may obtain the stored cookies for that domain, and for none other. Similarly, scripts and other browser languages are constrained by the same origin policy which is again domain-based. CSRF, XSS and all the related acronyms in which security practitioners revel are still about the crossing of the domain boundary. This really points at a security model in which each target domain is its own world, and a given browser instance should be contained in a box which allows access to that domain only (only machines in that domain, only cookies from that domain). If one browser instance gets subverted, then, hopefully, the sandbox mechanism will prevent subversion of other browser instances: if your browser-for-Facebook is hacked, your gmail account is still safe.
There is still contention for shared resources. Even if we can get the user to mentally separate his usage modes into separate browser instances (this can be more or less automatic, e.g. by having each set of tabs relative to a single domain to be managed by its own sandboxed process), the user still has a unique screen, keyboard, brain, pair of eyes and set of fingers. USB keys are a good example of problems: the user thinks of them as "files", not as "files for my Facebook-related tasks". The user will make files from USB keys available system-wide.
Moreover, users really love cross-site behaviours. E.g. they really want blog sites to feature Facebook buttons which do Facebook-related things right on the blog site. Real task separation is a constraint. This is similar to pressure doors in submarines: even when the doors are kept open, you still notice them and you still have to think about them when deciding where objects and men should go.
To sum up, having a separate account for system administration is not really needed in modern personal computers. You still need one, not because of any real gain in security (the sysadmin account does not protect that which is important to protect), but because current operating systems are still organized that way, and going against it may break too many things. It is mostly a matter of Tradition, as always.
What you need, if you want to mitigate effects of break-ins, is to apply separation of tasks, which is quite orthogonal to the separation of process that operating systems enforce; indeed, the Web browser is a typical example of a single process which spans several tasks, and this is incarnated by the cookie storage vault, which keeps all your dearest secrets in a single place.
And, of course, internal separation is still mitigation: how to survive breaches while keeping overall losses low. It is better if breaches are not permitted to occur in the first place... which again translates the problem elsewhere. In the submarine analogy, pressure doors are fine, but avoiding enemy torpedoes is finer.