OSes should allow me to create a sandbox for an app, so I can grant them access (and the app will not "break"), while still being secure.
There's another way: the app could instead use Android's Intent system to request a file chooser. This switches to a separate app which already has access to the filesystem (like the built-in Gallery app), which after the user has chosen the file, returns something which allows the original app access to just that file. This mechanism exists since the first version of Android.
If a photo management app needs access to your photos, you should be able to give it access to your photo library.
A better solution (imho) is to make the app think it has access, while in reality its access is limited to a sandbox.
Android should add the option for temporary data access. I would prefer turning on the access temporarily to send 1 photo, then turning it off a few minutes later.
https://developer.android.com/training/articles/security-tip...
See: https://developer.android.com/reference/android/Manifest.per...
If you don't mind sharing, what app are you referring to?
The file system itself should be well protected (on a non-rooted phone) as to prevent any unauthorized access to important data. Any app can only do whatever on the SD card if you give it permission to do so, but on the OS file system itself there isn't much they can do (again, on a non-rooted phone).
https://developer.android.com/training/secure-file-sharing/r...
Linux can also allow limited access to select filesystem data within a chroot() - this is done with a "bind mount."
Why these two security features were not designed around all Android apps from the beginning is beyond me.
OpenBSD is one of the best on that front, but it is a defense-in-depth mechanism, not something designed to run known-malicious code.
At least you can turn it off later.