Crossing the Golden Gate: macOS's fresh Application Support Protection

Summary Looks like moving the user’s TCC db to /private/var/containers/Data/ProtectedSystem/[UUID]/Data/Library/Application Support/com.apple.TCC/ was not the only change in the full privacy castle macOS 27. (What btw was a large decision as now attackers with full disk access permissions can’t modify your privacy settings)
macOS 27 quietly ships a fresh privacy mechanics I hadn’t seen documented anywhere: it extends the com.apple.macl protection that has always guarded sandboxed apps’ ~/Library/Containers/<bundle-id>/Data folders to a hand-picked set of non-sandboxed apps’ ~/Library/Application Support/<name> folders too.