It's tricky. Some of them are provided by the OS, some of them are not, my (possibly incomplete) understanding is that some are enforced by analyzing the submitted apps to know what they will request and not by blocking anything at runtime? I could be describing that incorrectly.

I would argue that permissions should be part of the OS itself and should work on every app regardless of where it came from, but there are people who know a lot more than I do about what specifically Apple is doing who have told me that's more complicated, and... :shrug: maybe they're right, maybe they're wrong, I don't know enough to argue with them about it.

Web browsers seem to be able to do this sandboxing at runtime just fine, so I don't really know why iOS is so heckin special, but it's not my area of expertise, I just know that there are apparently (?) some permissions that wouldn't work outside of the store.