Why a downloaded app can read/write to ~/Downloads/ without requiring the privacy allow permission in Big Sur?
I’m not sure I fully follow all the PS, but when you download the tool in the first place and execute or move the file, you are granting entitlements for the download folder and clearing the quarantine flags on the app signaling that the app can run.
Apple designed this to warn people when they didn’t intentionally run an app so the friction is for unintentional downloads is how I interpret why Apple designed it thusly.
You may need a session with someone to pick apart every step and evaluate each program closely to get a specific answer, but generally downloaded apps behave differently than ones the App Store installs with respect to sandbox and entitlement warnings.