Consider: An interpreter needs to run homebrew which installs new app, but the same interpreter running a script for your project should not read anything apart from those project files. Same interpreter needs to update local packages via bundle and git, but a random script you run shouldn't be able to access your ssh key via git commands. This is basically impossible to achieve without large compromises outside of selinux right now.

So how would you apply this principle to the python interpreter or to a program that gets compiled to a new executable many times during development?

I like the idea of granting folder permissions to regular third party apps I install and use. I always wanted that and I'm glad Apple is moving in this direction with the Mac.

But contrary to regular apps, language runtimes and software under development do not have a specific purpose. The whole point of software development is to create and test arbitrary code. It is pointless to grant privileges to code that changes in arbitrary ways with every keystroke.

During development, privileges have to be granted to the developer account, not to any particular software artifact. I generally think that granting privileges to software and granting privileges to people each has its legitimate place. One isn't generally better or worse than the other.

..and, office?! Do you keep spreadsheets in system folders?

I keep spreadsheets in project folders. Allowing full writes to a project folder allows taking over the shell. See above.

Folder-level permissions are not sufficient. Sorry, I shortened it too much, but basically - there's almost no practical difference between allowing writes to a dev project folder and allowing writes everywhere. (It would stop some really trivial attempts) Your actual system folders are safe of course... but who cares about those really?