Well, some of the permissions include things like “allow the app to track the user for advertising purposes”. There isn’t a technical way to enforce that with virtualization and sandboxing.

You can enforce it by booting misbehaving apps from the app store... but that only works if there’s one app store.

I _believe_ on macOS, if they revoke your certificate (the one you used to sign the app), the app moves into the "We can't verify that this app is free of malware" category, so in theory they can still do that.

But it is a nuclear option, and it would be a big deal if they did so for something "minor".