Not being able to give granular permissions to folders is not the problem of an app which regardless of being open or closed source may be compromised. Remember that the risk is zero if and only if you avoid the risk, i.e. in this particular case do not install Obsidian.

Macos:

- does not have a granular permissions model as far as I know;

- deprecated sandbox-exec that allowed to achieve the above;

- macos appstore is a very strange phenomenon, I would not put much trust in it by default.

Obsidian:

- has a system of community plugins and themes which is dangerous and has been discussed multiple times[0]. But the problem of managing community plugins is not unique to them. Malicious npm packages, go modules and rust crates (and you name it) anyone?.. you are on your own here mostly. And you need to perform your own due diligence of those community supported random bits.

Obsidian could hugely benefit from an independent audit of the closed source base. That would help build trust in the core of their product.

[0]: https://www.emilebangma.com/Writings/Blog/An-open-letter-to-...