I'm not surprised by news like this anymore. When will Linux distributions properly sandbox our applications?
Our phones have had a better permission system for years.
Android allows apps to read from the clipboard at will, though it does show a toast. GrapheneOS, I believe, asks for permission first.
Linux generally presumes that you run trusted software, not some proprietary program that is approximately malware. If you want a "sandbox" run that program as a separate unprivileged user or use bubblewrap.