We can't check the app permissions on Google Play anymore

Keeping an LRU list for files that were opened from outside of your own app becomes needlessly complicated [2].

Access gained that way isn't directly compatible with things expecting classic File API access (and sometimes those things are outside of your immediate control, like external libraries and even parts of the Android framework itself), and unfortunately the easiest workaround to that problem is just copying the file into your own private storage.

[1] As far as I'm aware, only macOS attempts to at least handle related files that only differ in their file extension, but even that still doesn't cover more complex file formats like playlists, or HTML or DWG files or whatnot that can reference arbitrary other files.

[2] If the same file is shared via different apps, the way things have been implemented on Android it becomes more complicated for the receiving to check whether those two incoming file shares actually refer to the same underlying file or not. Plus for an LRU list to make sense you need to try persisting the file permissions so you can still access the file later on [3] and also especially take care not to leak those permissions when you clean up the LRU list.

[3] Which also leads to some strange scenarios like when you switch to a new file manager and uninstall the previous app, all LRU entries in other apps that were originally opened via that previous file manager now suddenly become invalid.

That's completely legitimate. It needs those permissions to tell your guests when dinner is ready, where it is being served, and what is being served.

More seriously though, I bought a tablet many years back which shipped with a simple word game that had insane permissions. Among them was access to contacts. When I pointed that out to people they would claim it was required for multi-player support. When I pointed out that one could add the contacts manually, most of the people thought I was insane even though this was at a time when people usually added contacts to desktop applications manually. They didn't understand that some people viewed it as impolite to share contacts of others without their permission (never mind the privacy implications). They didn't understand that most people would only play the game in single-user mode because it was a single play game with a "multi-player" mode tacked on. The multi-player mode was literally tacked on to harvest marketing data.

It's a custom nudge. It's shown by the Spotify app. Clicking on the CTA takes you to the settings page or something.

For example, the app wants to access your contacts. Instead of "yes or no", you choose a subset of contacts that the app is allowed to see: could be all, could be none, could be a selected set (perhaps a special set of fake contacts). Whatever you choose, the app is told that these are all the contacts that exist on your phone.

If the app wants to access the camera, the options are: actual camera, always black pixels, a selected static picture, a selected picture that is shaking to add extra realism. Whatever you choose, the app is told that this is the actual camera.

If the app wants to access the disk, you could specify that a new directory should be created and the app would be told that this directory is the entire disk. Etc.

I can't just tell all my friends to use Signal, it's just not going to happen and would result in me getting left out of 95% of social events.

I do keep a separate phone for proprietary apps, though.