It’s an interesting architecture but you still have to trust the app. Once you authorize access to your data, the app can retain a copy of it, disclose it, sell it to a third party, even modify or delete it, unless you authorized only read-only access, which would suffice for some apps but not all.

I like this idea and look forward to seeing how well it works in practice.