This is a big general Flatpak apps issue: If apps are supposed to open files "located everywhere" they get the host permission. This is not sandboxed really, and having - ~/ - /run - /media - /mnt - ... Should be enough and address the problem. Maybe some more directories, but these should be set instead of host, at least. From a security perspective it would be best to have no permissions at all and just use portals. But this is lots of work, not needed probably too.
Unfortunately Elisa cannot use portals for this because portal-granted filesystem permissions are temporary, not permanent. So if the user went into Elisa's settings window and clicked "Add new location" and was prompted by the portal to choose a new location to find their music in, then Elisa would have access to that location only until it's quit, and then it would not have access to it anymore next time it's launched. New APIs would need to be added upstream before such a thing would be possible.
hmm... okay so this may be necessary to implement in the portals? A way to permanently keep that symlink?
It's something that would need upstream support... and lots of discussion, and also most likely some lecturing about why it's a bad idea and fundamentally violates the Flatpak security model.
I am not sure how the Portal on Android works, but currently that is in many parts my way to go, its pretty awesome. But yes, I think to have a good UX about all this, Apps needing to manage things, it would require one privileged app, like a KDE portal UI, to manage the filesystem overrides. A dream of Apps launching systemsettings pages or even popups, and setting that seperately in a GUI.
Yes, that would probably be better from a UX perspective: ask the user for permissions at runtime as they are needed, and remember the user's responses until revoked later. Unfortunately that's now how the portal system works right now: by design, the permissions grantable at runtime are not remembered. It would need to be changed upstream to a fundamentally different design. I think such a design would be better, but that's not everyone's view.