Bitwarden

Maybe by the makers of flatpak, maybe by the app developers

This falls on the app developers. They're supposed to be using something called XDG desktop portals. It opens a filepicker window on the host, the user selects which file they want, and that specific file gets passed through into the sandbox automatically, no permissions needed. Though it's not perfect either -- AFAIK there's no way to pass though a directory using XDG portal, and drag-and-drop is broken (at least on X11). For command-line apps (tho it's not really what flatpak was designed for), the equivalent is the --file-forwarding option.