It shouldn't matter what permissions an application asks for. It is up to the user to decide to grant the app access to a system, or to a mock system.
The "sandboxing" model of flatpack and the like is completely backwards. I'd even say it's user-hostile.
Yes it's been there for a while. But like flatpak and all other attempts to sandbox applications they tend to ask for coarse permissions like Home Directory and once you give that, it can read everything important.