In reality what happened was that apps and games demanded full access for frivolous reasons. Like Syncthing author which wanted access to all data because they didn't want to call Android APIs and wanted to only use Go.
Syncthing is written in Golang; the SAF APIs don't work with native code