Comment by daveidol

How would macOS know if the request is coming from the URL bar or not in some untrusted software?

These permissions are clearly all-or-nothing, or else they wouldn’t work.