The old API works this way. Random games requested the "access all files" permission. This was bad and the rest is history.

The better middle ground is the new (9 years old) SAF API. The SAF API simply presents a directory picker to the user. The user can give the app access to any directories he likes.