It shouldn’t complicate the program itself, everything should be sandboxed by default.

And they should simply not have access to my home folder, it should be given access to a specific file only it is about to read.