Sorry, I think think my comment came off too dismissive.

I do think that self-reports on permission usage are a step in the right direction, and can also help in decentralized uncovering of unintended API access.

However I think with the recent pace of supply chain attacks, I think we'll be in for a rough couple months until a sandboxing system is added.