I have the same experience as you and joegibbs.

I imagine it's really hard to find an adequate in-between that works in general. (Edit: but it also feels like a CYA thing.)

The settings.json allowlist gives you exactly this kind of granularity. You can permit specific tool patterns like Read, Glob, Grep, Bash(git *) while keeping destructive operations gated. It's not as discoverable as a CLI flag but it's been working well for me for unattended sessions.