There are a lot of hardcoded paths within ~/, including macOS-specific (~/Library/Application Support, ~/Library/Caches, etc.) and Unix-inherited (dotfiles). E

There are a lot of hardcoded paths within ~/, including macOS-specific (~/Library/Application Support, ~/Library/Caches, etc.) and Unix-inherited (dotfiles). Essentially all applications need to access at least some of those, so you'd have to grant permission to every application you open. In contrast, hardcoding paths within Documents or Downloads is uncommon and considered an antipattern; thus, most applications only access Documents and Downloads when the user manually chooses a file within one of those directories. If the application is using a standard OS file open/save dialog, it automatically gets permission to only the files the user chose, without having to grant it blanket Documents and Downloads permission. In theory you could make the permission correspond to "everything in ~/ except dotfiles and Library", but that would be more confusing. That said, the whole thing is a hack. The "proper" solution is/was App Sandbox, where the whole home directory is virtualized, and apps get a whitelist of what they can access rather than a blacklist. Much more secure! Too bad nobody adopted it.