> gigabytes of data on one of my disks

This would require some cleverness at the device itself - perhaps a throttling mechanism and entropy checks on the content to effectively limit how much encrypted (or, sadly, compressed - they can't be easily told apart) information you can write to disk. Exceeding it would make the disk unusable and, perhaps, require very annoying manual intervention. The device also doesn't have any way to warn the user without going through the computer and the OS which, at this point, should be considered hostile.

> or network locations

This is easier to tackle by keeping backups and snapshots that are invisible and inaccessible to the end users and their OSs. Even if your workstation is mounting remote data as virtual block disks, you can still snapshot the whole disk at any given point in time. The problem will be cost - this requires a lot of extra storage capacity.

> I would not be annoyed if a popup asked me to verify that this is something I approve of.

In general the user (and anything on their machine) cannot be trusted. This confirmation should go to a separate channel - a phone call or other alert that's not going through the suspect computer.

Lots of Apple fans were not sharing your opinion when Catalina came if I remember things correctly. If the safeguard is not calibrated correctly, people will just click "okay" all the time. If the ransomware is smart enough, it will rate limit itself or will distribute the work between different processes, including innocent ones that it has managed to inject itself into.

Not saying that it is not possible, but its usefulness might not prove as high as hoped.