Maybe this is a stupid question, but what makes you trust the app when you mistrust the installer? Or mistrust the installer when you trust the app? Shouldn't both come from the same more or less trustworthy source?
I’m not sure how relevant the difference is considering most valuable data is owned by the user, but also because MacOS has evolved the security model well beyond the UnIX standard.
I trust Microsoft not to be literal malware, but I don't trust Microsoft to avoid doing stupid unnecessary crap to your Mac.
Moreover, it is also quite granular. You can allow access to "Downloads" but still have to grant permission for it to access "Documents" later.