It shouldn't matter what permissions an application asks for. It is up to the user to decide to grant the app access to a system, or to a mock system.

The "sandboxing" model of flatpack and the like is completely backwards. I'd even say it's user-hostile.