That is exactly what snap is aiming for.

Apps run in a sandbox and have no access to user files except through "portals", which are secure file pickers essentially.