Comment by kuschku

The OS provides restrictions and permissions so that the user can apply them to apps.

If the user chooses to free certain apps from restrictions, that should be their choice.

But if a piece of software overrides the users' choice, that certainly qualifies as a CVE.

This is an important distinction! The user must always have final say.

Whether an app breaks out of the sandbox and steals my vacation photos, or the OS sets new restrictions I can't remove, both are wrong.

Any piece of software has to act in service of the user, and ONLY the user. It must not do things or set restrictions without the users consent. No means no.