I don't see why granting access to an app would grant full access to the whole thing. I.e. similar to how apps don't get full filesystem access. I also know nothing about how it's implemented though.