[yjftsjthsd-h]

I think I agree with your general point, but I have to point out that the correct solution - implemented by Flatpak, Android, and I believe macOS and iOS - is that selecting an avatar should use a file picker that only hands the app access to what it needs, and a request for full filesystem access is a red flag.

[MyPasswordSucks]

Yes, but now I have to contort my file organization around the preferences of the machine, which is completely backwards to how the user:device relationship should be. My files belong where I feel they belong, optimized for the idiosyncratic and individualized workflow that works for me.

And of course, it kinda also doesn't change much, since (assuming I've learned to give in and submit to Moloch's $HOME) now all my documents are in the siloed "these documents can be accessed by apps" area, still just as ripe for upload to Scary Hacker Dudes or CTRL-H shenanigans. Giving the app access only to its own personal directory would make the hypothetical avatar feature impossible (well, possible only through exiting out, opening gallery, finding a suitable image, manually copying that image over to the app's personal directory... and all that on mobile... yeugh), as well as a whole lot of other features we (should) take for granted.

So in the end, we still have the initial pointlessness, we've just sprinkled in a fair amount of annoyance on top.

[yjftsjthsd-h]

Er, no? To select an avatar, the app triggers a file picker, you navigate anywhere in the filesystem and pick a file, and the system hands the app just that file with no access to anything else.

In the case where you want an app to have persistent access to a directory, it's true that the easiest way is to use the normal filesystem layout and then take the default mappings, but at least with flatpak you can tell it to map in arbitrary different directories and then use them just fine (ex. I've used this to give Steam storage on external disks).

These features are effective when used, and while they can have inconveniences, those rough edges can be rounded off by customizing the protections (while still protecting most of the system).

[MyPasswordSucks]

Oh, yeah, duh. Sorry about that. The file picker route is generally fine*, though I still think the edge cases where I want a program to be able to modify another program's files in-place are numerous enough that I don't think it should become a "soft-standard" on desktop environments.

*As long as it isn't GTK browser on Windows, which absolutely should be a U.N. matter.