This would imply the game state is stored in a centralized app view, at which point the general atproto ethos that you can move your data if an app becomes bad is up to the app.

I believe the viable solution in a rich permission system is one where the user cannot directly modify a record (as defined by a permission schema for a specific app/type) and can only call methods.