I'm not surprised by news like this anymore. When will Linux distributions properly sandbox our applications?

Our phones have had a better permission system for years.

Linux generally presumes that you run trusted software, not some proprietary program that is approximately malware. If you want a "sandbox" run that program as a separate unprivileged user or use bubblewrap.

Android allows apps to read from the clipboard at will, though it does show a toast. GrapheneOS, I believe, asks for permission first.

Thankfully iOS rolled out a permissions prompt for this. Pretty illuminating just how often other apps read the clipboard, e.g. Google Maps reading my clipboard every time I tapped on the text field to search for a destination.