It runs as a user without the necessary permissions to access those devices?

So one should configure an alternative user for each group of permissions that any arbitrary app might need? Then what happens the day that I do decide that my weather app should access e.g. my location? Now I should move all its data and update my launch scripts to the new user?

I happen to dislike snaps as well. The hard coded install directory is a passion point for me. But at least the permissions issue they are getting right.

I wish that desktop distros would adopt the Android permissions paradigm.

No, you can create groups for permissions that you'd like to enable and disable and add the user to the appropriate groups.

The snap service tends to run when it wants and it can slow down a system when it runs. Also the snap binaries are a lot larger than with apt.

Honestly, I don't think a weather app would access a camera or microphone. That seems like a bad example. Honestly, I put a piece of tape over my camera. It looks like other posters in this thread have solutions.

Using more hard drive space than needed and not being able to control the service are show-stoppers for a lot of people, and it looks like the permissions issue has another solution.