How is UAC a security improvement?

Basically, there are two kinds of protection. First is user - such window prompt makes the user think about what he is doing and if this action was really intended. With UAC it is simpler to guide users in regards to what should be accepted and what must be restricted. Second protection is the system itself - even with administrator rights there are many limitations on running processes.

For those who want to delve into details, here is a link to the blog of renowned security expert Joanna Rutkowska: http://theinvisiblethings.blogspot.com/2007/02/running-vista-every-day.html. In this post she explains UAC and a vulnerability that was found back in 2007.

There is always a limit to how much the OS can protect the user from himself.

But UAC is firstly concerned with blocking processes from performing potentially destructive actions without your knowledge, so it asks for your explicit approval. Yes, you might still run a virus because you wanted to see the dancing pigs - but that's YOUR choice to ignore the warning (and basically, thats what it is: Continue at your own risk).

But there is a tradeoff here: You can set UAC to require a password for EVERYTHING, but that would be so invasive and disruptive that everyone would either ignore it or shut it off completely. This way, if you WANT, you CAN pay attention to when it really matters (apparently), or you can consistently and explictly choose NOT to.
It's like when you get in your car and start driving - the car starts beeping because you're not wearing a seatbelt, which you should. But you can ignore that if you want to, at your own risk.