Comment by mike_hearn

That explanation sounds wrong to me. I've written my own implementation of macOS signing logic. TCC doesn't usually tie permission grants to paths, it ties it to the designated requirement of the app bundle, which in turn is usually an indirection through the code signing certificate identity. The whole macOS architecture is designed to let you drag apps around and treat them as files, it's not a UNIX where installation path is meant to matter.

I just dumped my TCC database and the entries are mostly not path tied. The Chrome entry is as expected a bundle ID+designated requirement. Unless the local network permission inexplicably uses a different permissions engine, that statement is a misdiagnosis of what's happening.

     $ sudo sqlite3 "/Library/Application Support/com.apple.TCC/TCC.db" "SELECT hex(csreq) FROM access WHERE client = 'com.google.Chrome';" | xxd -r -p | csreq -r /dev/stdin -t

    (identifier "com.google.Chrome" or identifier "com.google.Chrome.beta" or identifier "com.google.Chrome.dev" or identifier "com.google.Chrome.canary") and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = EQHXZ8M8AV

In other words, the permission grant applies to any Chrome channel as long as it's signed by Google's team ID.