This brings me back to something I have always thought was lacking in OS security permissions architectures:

WHY IS THERE NO WAY TO SET FILE PERMISSIONS PER APP???

We can set granular permissions per file and folder for elaborate hierarchies of users and groups, but there's no way to say "Don't let Notepad.exe read this file", or "Only let ls access this folder"

macOS's Sandbox is a roundabout way of doing this (manually choosing a file via the Open dialog gives that app implicit permission, but it doesn't work for non-sandboxed apps of course)