In the security tab of settings it’s possible to see all active sessions and you can create specific app passwords.
Would it be possible to specify a root folder for this app? -> If the app connects via WebDav with this specific password to the server it will see it’s own subfolder as the root folder and has only access to the files in this folder.
This would be a great security improvement for all applications which need only see their own files, for example to sync data like notes, photos, settings etc. between devices, or my mobile scanner app which only needs access to one folder for uploading my scans, not all my private data.
To make this more user friendly the user could provide an unique app name while creating the application password and NC will store all its data into .apps/appname/.
It would be a great alternative for mobile apps to offer sync via Nextloud instead of iCloud etc. without exposing all your private stuff to any app.