This is how privacy-preserving advertising works, yes. To be entirely honest if this works I think I’d agree with that term!

in this hypothetical setup you're effectively downloading malware, I wouldn't really consider that a loophole. Regulation that concerns data ownership can do precisely what the name says, give you control over where your data lives.

If you have full sovereignty over your data and your computer and you decide to use software that downloads ads and blasts them to you, at some point even in the best jurisdiction you're responsible for what you install

It does matter. Your interpretation of “data collection” leads to absurd results.

How far does this go? Are the Bayesian spam filters that email clients have had for years that use your own classifications GDPR violations because they collect data about what you do or don’t mark as spam? Is your browser a GDPR violation because it collects data about your system that can be used to fingerprint you? Does your OS violate the GDPR when it displays your most recently accessed files in a file picker or as first suggestions when you search for something? Is the SMART monitoring built into your drives a GDPR violation? My understanding of the GDPR is that it applies to data the company is collecting about you. If the company never gets the data in the first place, then they haven’t collected it.

> Data collection is still data collection, it doesn't matter whether I am the one processing that data or a third party

It absolutely matters who collects or processes for who must be GDPR compliant.

You should admit it’d be a bit silly to give notice to yourself that you are processing your own data!

Every piece of data on your computer that is owned by your user is available to any other app you run as your user. That's hardly unique to this data, and is a well known issue when it comes to personal data and the applications you run under the unix permissions model. That this is at least behind the "full disk access" control makes it more protected than something like all of the tax and accounting data your financial software is storing in your Documents or home folder (well, technically under macOS your Documents folder also has its own permission, but it's the same sort of thing where anything with permission to read from your Documents folder can read anything in there).

It's an eternal balancing act because every time Apple implements some new restriction in their OS that prevents apps from doing whatever they want, whenever they want, people get mad at them. But without those restrictions, the ever increasing amount of personal data that is stored on your computer is exposed to the ever increasing number of data slurping applications that you run.

> A permission that make apps ask for and others need to work (e.g. a terminal replacement).

I assume you mean 'many' and not 'make'—this is untrue; you only need to grant FDA if you're trying to access protected areas, like the knowledge graph store.

Granting full disk access to an app that you don't trust not to surreptitiously exfiltrate your data is the kind of user error where the buck stops with PEBCAK.