That’s not true on recent versions of macOS. Apps have to ask the first time and you can grant them access to specific folders / services only.