Deny any app that needs a background helper and elevated access would be the safe way to sandbox and protect your data. If you grant full disk access and your admin password, all of your data is exploitable, it’s just a matter of how smart and intent that program is to harvest and exfiltrate the data.
- If you grant full disk access and your admin password, all of your data is exploitable.
- If the intent of that program is to harvest and exfiltrate the data, it can read everything. Not all apps will do that or even be programmed correctly if the intent is to harvest data, but you’ve opened the gate if you allow that entitlement.
(Since you didn’t name a specific app, we can’t weigh in on how secure or like malware it might be - it could be very well designed and not designed to harm your privacy. )
Sounds like the install process is game over for you in this case. Apple ships malware detection and removal tools, and goes to great lengths with these alerts, a framework for code signing, and putting up these restrictions to get most people aware and to say no to apps asking for permissions they have no need to run.
As to everyone thinking there is no risk, that’s hyperbole at best. Here is where I would start to educate and protect your Mac and learn about malware detection and options.