I actually think Decker might have an interesting interface opportunity here.
The filesystem access you described through a manual file-picker is an example of a security pattern called a powerbox - some less-trusted application code is able to interact with a more privileged object, which can selectively share its access to important things like the filesystem. This same pattern could be extended to the use of other potentially sensitive resources like network access, though. For example, you could potentially have a network-picker akin to a file-picker, but instead of picking a particular file from the filesystem, the user is able to pick a particular network resource (a URL, say). The network-picker in this case could be a part of Decker that does have unfettered access to your network interfaces, but not necessarily every deck you load would have the same authority.
What a good UX for something like this might look like is up in the air; it's a pattern that's really only frequently used in file- and media-pickers, so there's a lot of unexplored territory. (The media picker in recent versions of Android and iOS is basically a powerbox as well, for example.) The only place I've seen a network picker done before is in Sandstorm; it was a bit awkward there because most apps running on it were not Sandstorm-native, and were built assuming they had full network access. But that's why I think this pattern might be interesting in Decker, which isn't trying to support a bunch of existing software that wasn't written with Decker in mind.