I think this sort of thing is a capabilities ladder in an arms race.

If you never evolved account based security, you never built the infra for even evaluating application permissions in the first place.