No, Safari is just an easy way to exploit this bug.

In principle, it works with any app that can be convinced to run arbitrary code by changing its resources. What Safari is doing isn't wrong and wouldn't cause an issue if TCC would check the entire app, including resources.

It's true that you can't use this to copy the privileges of _any_ app, only of those that have this property.