In reality what happened was that apps and games demanded full access for frivolous reasons. Like Syncthing author which wanted access to all data because they didn't want to call Android APIs and wanted to only use Go.

Then warn the user and let them choose.

Syncthing is written in Golang; the SAF APIs don't work with native code

They do if you bother to write bindings.

ie go through a process that's about as painful as re-writing your application from scratch.