_Technically_ it doesn't have to be.

Super user is super user. It can always access anyone's files. Allowing unrestricted access to super user essentially destroys any sense of security.

You can very much allow only access to certain commands under super user, e.g. only allow users to run pacman. Of course now you are trusting that said commands won't leak the permissions.

I agree that it's a mess.

My personal and biggest issue is not even across user boundaries, but inside a single user.

What do you mean my Firefox client can read my .ssh files???