Maybe.
On Android, iOS, Firefox extensions, and many websites, you can't give permission for one thing without giving permission for everything. Or those "I accept cookies popups" -- until recently, you couldn't choose which cookies you wanted to accept, so either you accept tracking cookies in order to use basic functionality, or you head elsewhere. The application developer could be a good citizen and request on the permissions needed -- but it's just easier to request that they be able to read and modify any and all data, regardless of their need or desire to do so.
On Windows, Unix, and other "system-level" permission systems, you have a different problem. There, there is no real ability to verify what an application is trying to do with its elevated permissions -- it just wants to be given God power, even if it only needs permission to do one or two very specific things in one or two very specific locations.
In fact, the web browser is probably the most accessible place to roll out a whitelisting-based permission system. It has already been demonstrated successfully with uBlock Matrix and uBlock Origin -- you can block specific types of activity coming from specific subdomains. Some sites break completely when you block the few specific elements you don't want to see, but most work just fine, or at least close to fine. Being able to whitelist specific Javascript APIs (e.g. the battery API, the ambient light API, etc) is a logical next step in my opinion.
An OS-level analogy would be the ability to block specific syscalls made by specific processes, optionally only when spawned by a specific parent process.
