Agreed. Programs like Zoom, Steam, and other closed source "apps" should always run either in a separate user account or in a bubblewrap.

I agree. But sometimes I struggle with finding the right files under /dev or /sys so that the necessary hardware is accessible to the program. Is there some documentation that gives a good overview over the different device and system files? For example, if a program wants to use my web cam, how would I figure out which files to mount?

You may need a general knowledge in device and device drivers in Linux (the BSDs behave the same but follows a simpler approach). Basically the naming scheme is based on the driver name with numbers and letters appended for device ordering. So sda1 means scsi disk (sd driver), a for the first one, and 1 for the first partition. Linux added a few folders and scheming for better interactivity.

/sys is powered by sysfs, which is actually a database as file and folders. OpenBSD doesn’t have it (and /proc too), so if you need to interact with kernel objects, you need to use C and the system library. But on Linux, you can do a lot with basic read and write on files.

An LLM can be useful to help you figure out stuff like that.