I have experience deploying to Fargate from ECR and we didn't need to configure any sort of S3 access to do it, certainly for the ExecutionRoleArn. ecr:BatchCheckLayerAvailability, ecr:BatchGetImage, and ecr:GetDownloadUrlForLayer on the ECR repos was sufficient.
YES! Here is an example.... I wanted to use Elastic Container registry and have Fargate pull from it. I had to figure out that ECR is actually implemented like a private s3 bucket and my app needed read access to S3. Why should I be exposed to the implementation details as someone granting permissions to ECR?! Also to figure this out it is not trivial as the only way to get a clear error message is to run Cloud Trail and wait 10-15 minutes for the error to be reported there as there is a delay. Also another instance where something needed permission to an weird internal S3 endpoint for gateway access on a VPC....