This expectation exists because Apple/Google/monopolists sell it. But it's not realistic, the app stores are cesspools. We need a culture shift to being more selective about installing software. Clearer permissions, better architecture, and trusted repositories with reputations to maintain. Installing software without any validation of safety should be possible but scary (show a terminal log reporting useful technical information or something).
Permissioning is a mess – among other things of course. I feel that permissions to access any resource(image, location, files etc) could be given without necessarily giving access to the PII value that resource holds, e.g. running a no side effects function on it on-device or on a trusted service that is readonly to me and write-only to 3rd parties.
