For humans who are paying attention, sure. In practice, not really, because it's all done by scripts without an easy way to query "is this ___domain shared".
Let's rephrase then: why does owning stock imply financially supporting the company? After IPO, you're not buying anything from the company, you're buying from other investors.
Not only that, but your goal as a shareholder is to benefit financially from the company. If a company is a bad actor and you know it, you are expressly financing and benefitting from bad acts. I’m not sure why other commenters are trying to abstract this fact out of existence. It is not rocket science!
So if you buy stolen goods from someone who bought the stolen goods from the thief, and you knew the goods were stolen, you are doing nothing unethical. That’s all you’re saying, which is a position you can have, but it is a sad one. And you are, in fact, contributing to bad acts. The initial buyer may not have bought the investment if they knew there wasn’t a rube down the line that would take it off their hands.
I think the rest of your sentence was "by default" which is the same thing the comment you're replying to said: "security gets in the way of everything"
The problem is that defining a reasonable policy for any modern app is a gargantuan pain -- as is the case with any security policy language -- so as the GP said people hated it and now it's dead https://openjdk.org/jeps/411
I think a key part of solving that is by not thinking of it as a set of security enforcement rules on top of the preexisting platform, but as a new platform (that just runs everywhere). So, instead of ACL listing what files can be accessed, shove it in a sandbox where the app has its own files, and the platform open file dialog enables the user to authorize one-time access to individual files.
You basically can't take a complex thing and write complex security rules for it and expect success & real world adoption.