> Granting terminal full disk access grants arbitrary scripts full disk access

No, it grants scripts I run full disk access. Unvetted scripts do not run in my terminal, so there are no secret sub-processes either.