Instead of replacing the executable, couldn’t it be wrapped and augmented, so it’s just running payload in the background with the original permissions and keychain access? It does seem pretty bad.

No — the victim app is code signed and the permissions and keychain access are tied to the cryptographic identity used to code sign. Replacing or wrapping or whatever here must happen with a different cryptographic identity (unless you actually exploit the victim app itself which is a whole different thing).