Ubuntu frequently asks for credentials when downloading updates. What is to stop malware from just producing a pop-up that mimics the same behaviour?
Nothing stops a program from creating a dialog that asks for your password. It's your responsibility as a user to only enter your password into trusted programs. However, all of this assumes an attacker cares about becoming root, which it may not care about.
For the most part an attacker can do most everything they want without becoming root in the assumption you will login to the same user again at a later time. If they want to fire up their botnet or start encrypting your files they can do that without being a super-user.
The most effective tool in Linux that stops malware is the trusted repository and package signature system. In Windows you typically download .exe files from arbitrary websites, at any layer they can be infected from hosting to transmit etc. In Linux most software is found from the central repository of software which has been signed by the Ubuntu team. If the package is modified the signature will not match and the infected package will not run.
Overall if you only install software from trusted sources and never run random binaries you find from the web you will have a secure system. Linux just provides the user tools to accomplish this better.