Because vulnerabilities, coarse access granularity and lazy or ill-informed users. E.g., you now grant cam access per domain. Changing functionality on that domain doesn't revoke permission, so a simple bait and switch is already possible. Now imagine granting access to your file system to some Microsoft domain and finding out that there was a change of heart and some new script has uploaded your files to OneDrive and deleted them from your disk.