Isn't that more than a typical sandbox what you're asking for?

The GrapheneOS developers said they're working on a feature where every app could be run in its own VM, like on ChromeOS: https://discuss.grapheneos.org/d/20647

> some folders, no camera or mic etc. I understand that app permissions do the same

The "some folders" part is already true for Android. Apps can't blanket access files/folders of other apps (save for ones stored in "external storage", which has also been scoped down in the recent releases: https://source.android.com/docs/core/storage/scoped).

> more convenient than having to define granular permissions each time you install an app

It isn't Android that makes this inconvenient. It is the app developers that cause "prompt fatigue" (by showing permission requests repeatedly) or "blackmail" by refusing to work until permissions are granted. A new sandbox mechanism is unlikely to change much.

That's why spoofing should be an option. You want GPS? Timbuktu. You want my camera? Here's a close up video of a saggy scrotum. You need access to my contacts? Here's an address book with the contact details for all the funeral services within a 50 mile radius.