You never get nagged to take $5 out of your wallet to hand to an untrusted person, why should you get nagged to drop a file into an application you don't trust.

I suppose, you never have been to a significantly poorer country? (outside of the protected tourist areas).

Or well, spend time with kids, who really want something.

Begging can get very intense.

And about file permissions, well - are you aware, what kind of permissions the standard free app on the google play store will ask of people? And yes, I won't use them. But I use WhatsApp. Did not wanted to give permission to read contacts, or wide file access. But denying it, means it is allmost unusable, so I also eventually gave in ..

The clerk at the store doesn't ask for permission to take your payment.

  onSave() =>
    fh1 = GetFileWritePerm($documents + "/project.foo");
    fh2 = GetFileReadWritePerm($myFolder + "/cache.db");
    while(!fh3) {
      fh3 = GetFileReadWritePerm("/etc/passwd");
    }

You'd think that would be really rude of the app. That may have mattered 20-30 years ago. Today, most consumer-facing tech companies - big corporation and small startups alike - adopted "being a rude, obnoxious asshole" as a business model.

Note that this includes all the major commercial OS vendors too - i.e. Apple, Google and Microsoft. This creates a new challenge: how do we design secure systems when neither the apps nor the OS itself are trusted parties? How do we develop this security framework, when untrusted parties are the ones gatekeeping adoption, and also most likely to be developing it?

In other words: how do we maintain security for hens, when the foxes are guarding the hen house?