Sure, you stick things into sandboxes and only allow specific permissions to access outside the sandbox. In which case, users habituate to allowing any permissions that anything they install requests (c.f. Android).

So then maybe you say "no permissions are allowed for sideloaded applications", but then you're back here with people complaining that the platform owner is crippling the independent ecosystem because it doesn't allow access to the camera or the mic or the address book or whatever.

Or, you take the more extreme step, and obfuscate from the application whether or not permissions have been granted. The reason why people default to granting excess permissions is that many applications simply will refuse to run without them. If instead of "overtly deny permission" there existed the option to "covertly deny permission (by opting to feed plausible random data instead)" and making that the easier to select "deny" then you have the best of both worlds: well-behaved applications start asking for fewer unnecessary permissions, because the data they're gathering is being poisoned, poorly-behaved applications have their harm reduced, and users who want to build programs that actually need high-level permissions can do so.

It's not much of a sandbox if permissions exist to escape the sandbox. All "secure" apps (mail, pay, banking, chat, ...) need to live in a special compartment which they cannot escape, and no installed apps are allowed in this compartment, only builtin apps.

Everything else lives in a more relaxed compartment which cannot access the "secure" compartment at all.

Essentially two devices, one completely locked up, the other completely open.