As a temporary workaround, it looks like you can add the app group ID prefixed with the team ID in your .entitlements file, and the macOS app will build and use the correct app group directory without asking the user for permission. Then, to allow your iOS app to build, you'll need to remove the macOS app group ID from that file. I haven't tried submitting to the App Store with this setup yet, but assuming it works, you'll need to remember to include the correct app group ID for each build you submit.
Since Apple is unlikely to change their access control policy for app group directories on macOS, the most sensible solution would be to create a separate app group section for macOS under "Signing & Capabilities" in Xcode, which allows you to specify the correct app group ID for macOS.