But even if you allow filesystem access, it's only for 'non-system' partitions (e.g. sdcard). Unless you rooted your phone (also a pretty tedious operation with a potential to brick the phone), normal apps can't even read files on the system partition, let alone overwrite them, except their 'own' data.
This is good from the security point, e.g. you can run pretty much any app and simply remove it if you feel like it's suspicious and asking for too many permissions. Similar to running a random Docker image: you can try out software without taking risks of losing control over your system, allowing certain capabilities if necessary (e.g. ports, paths). There might be a Docker vulnerability of course, but it's pretty unlikely for you as an individual to be targeted by it.
But it's extremely frustrating when you know what are you doing and which risks you are willing to take, but have to jump through hoops to do things that are otherwise trivial on desktop.
In theory, you could request broad permissions, and have an interpreter sitting inside your app, dynamically loading its own code over the wire, so you'll never have to update from the app store (unless you want more permissions granted). But as far as I understand, this is forbidden by the Play Store policies (e.g. Facebook got told off for doing this https://arstechnica.com/information-technology/2013/04/googl... ). Although I'd imagine it's easy to slip such code past reviewers, unless your app is very popular and worthy a more thorough review that can catch it.
Also I'd imagine there is some grey area there, e.g. your whole app could be a webview simply displaying web frontend -- surely it's okay to dynamically load javascript? Not sure how the policy works in such cases.