This question is based on an observation of Android's powerful security features, In my old Android Lollipop third party apps had read access (but no write access) to external SD card, but my Android Pie prevents apps from even reading / writing data to the external SD card? But the preinstalled apps will prompt to aquire these permissions. Is there a way for app developers to circumvent this ?
Comparing permissions across Android versions is tricky and misleading. More so, when you want to compare Lollipop permission model to that of Pie. The differences are many and too vast to be covered, perhaps even as a separate question .
Pre-installed apps may be OEM /carrier dependent (bloat ware) called system-apps. They ask for permissions which are required by them, just as user installed apps. However, by virtue of being system apps (see system-apps tag wiki), they are privileged, in the sense
being "trusted", they can get access to some restricted app permissions which are not available to "user-space apps" (e.g.
ACCOUNT_MANAGER,MANAGE_APP_TOKENS); if a user-space app requests those, they are denied.
You can read the linked tag wiki for more on system apps
Q & A