I previously gave access to an app to access removable storage (because there was no more granular way to just give the app access for a single folder - which is a serious freaking defect if anyone from Apple is reading this - that’s just plain bad), did some editing, then revoked the access.
The problem is the access wasn’t revoked and it could still access the whole drive. Checked the settings pane - definitely no access to removable drives (and no full disk access), went back to app and it could still access.
Went through tcc on the command line and it showed that the access was revoked but still it persisted reboots.
In the end I had to completely reset the machine and start from scratch just to revoke that drive access.
macOS really needs another Snow Leopard “no new features” release.