Yep. But authorizing things on a file-by-file basis would be a terrible UX, while granting programs blanket access to all of ~/.local wouldn't be very secure,

Yep. But authorizing things on a file-by-file basis would be a terrible UX, while granting programs blanket access to all of ~/.local wouldn't be very secure, since lots of programs need something from there. It's the same situation as ~/Library for macOS-specific code. App Sandbox avoids this problem by giving each app its own virtualized home directory, so that data sharing between apps becomes opt-in instead of opt-out. It still exists... too bad nobody wants to adopt it.