I'd say something like GNUCash is an application, but hledger feels more like a program. Brewtarget is an application, but bc isn't.
Certainly app and application are synonyms.
https://www.cnet.com/tech/mobile/more-than-1000-android-apps...
https://www.xda-developers.com/android-permissions-bypass-pl...
You can allow certain common kinds of sandboxing crossover - apps that want to touch the camera roll, apps that want to touch wireless/location data (which are one and the same), ones that want to use the contacts, etc. But at the end of the day if you don't fall into one of these buckets you're going to have an awkward experience going into the OS and approving moving stuff into/out of the sandbox.
It'd be nice if you could allow complete crossover for certain apps - so, VLC can touch all of the podcast app files, or whatever. But I can understand why they don't even want to cross that rubicon.
You've gone and conflated user and application permissions. I was talking about owner permissions. The device owner should always have the ability to backup any file on the system. Only Apple controls the entire system. They can and should give this control to the owner.