Well, some of the permissions include things like “allow the app to track the user for advertising purposes”. There isn’t a technical way to enforce that with virtualization and sandboxing.

You can enforce it by booting misbehaving apps from the app store... but that only works if there’s one app store.