> For the OS-managed databases (photos, contacts, music etc), the exposed APIs vary wildly in how they manage permission

That's the key indication that there aren't capabilities underlying the databases. If there were, access would be more granular and uniform.