Ahh, thank you!
• I had come across startAccessingSecurityScopedResource(), but wasn't sure if I needed it. I had previously tried implementing it, but must have done it wrong.
• I switched to Data.init(contentsOf:options:)... My URLSession was most likely from a tutorial about loading .json from elsewhere.
• Nice WWDC link, helpful overview.
All in all, with switching to Data.init() and correctly and carefully implementing startAccessingSecurityScopedResource() & stopAccessingSecurityScopedResource() has it working correctly now. Thanks!