The apps still need to request OS for specific permissions before they use things like GPS, mobile data, filesystem etc.
But the point you’re missing is unless you’re building everything yourself, there is always a party that you have to trust. Apple likes to paint itself as trustworthy when it comes to your data, but all the anti-consumer shenanigans they do when it comes to hardware clearly state that the only thing they care about is money.
Remember - it’s either convenience with a false sense of security or security. Never both.