The default permissions of the (typical Mac home) user are: read access to most of the filesystem, write access to the full home directory, /Applications, and some other locations.
Re:Goodbye Mac App Store
by oneeyedpigeon on Saturday March 11, 2017 @08:12AM
(#13845314)
So that's not "full access to my filesystem" by any means. Maybe there could be a bit more nuance, but I don't think this is an unsolvable problem.
Surely an app can only do that if it requests escalated privileges. By default, I would expect it to have the same filesystem permissions as the user that launches it.