Another thing that’s confusing to me is similarly with some applications requesting access to folders.
I swear I’ve had situations where I download some software, and then I try open with it some file in my Downloads folder. OSX then shows a pop about requesting access. I remember either just ignoring that pop up or clicking cancel, and then still having the software somehow load the file! That seemed like a serious security issue and I don’t really trust those filesystem access protections on osx anymore.
macOS will allow access to single files to software without any permissions if the action to open the file was deliberately done by the user (e.g. the file was selected in an OS open file dialog, the file was double-clicked, or dragged onto the app icon, etc). The app gets a runtime-limited lock on that one file and still can't willy-nilly list or read other files.
IIRC this is also the only run-mode for sandboxed App Store apps, where all file opens must be user-initiated (and some utility apps work around this by asking you to open the disk root manually)
