Just a guess:
Since /System/Volumes/Data/ contents are merged into /, you need to replace those paths accordingly (i.e. replace that long prefer in a path with the root path), and then you'll probably get permission.
If that works, then I suspect that the Sandbox path access validation code has not been updated to match these aliased paths when volume groups were introduced. I've run into several related issues, outside sandbox, and need to employ similar work-arounds.
One would hope that Apple would provide APIs for determining the members and paths of volume groups, and conversion methods, but that's not happening (see also https://stackoverflow.com/q/63876549/43615)
Oh, and if you don't like the path replacement method, you could also try getting the CanonicalPath instead - that should also point to the regular path, but take more time than the simple string replacement. If you only do this for a few bookmarks, that shouldn't have an impact and is safer.
In fact, there are two ways I use in my apps to get the canonical path. I don't remember which one works, so try them both:
Get the fileReferenceURL
This code (see also https://stackoverflow.com/questions/64720189):
NSString* canonicalFilePath (NSURL *url)
{
// Caution: Will expand /var/ into /private/var/
NSString *result = nil;
if (@available(macOS 10.12, *)) {
NSString *cpath;
if ([url getResourceValue:&cpath forKey:NSURLCanonicalPathKey error:nil] && cpath) {
result = cpath;
} else {
result = url.URLByResolvingSymlinksInPath.path;
}
} else {
result = [[url fileReferenceURL] filePathURL].path;
}
return result;
}
