The microk8s snap needs to have write access to
~/.config/helm because it can either operate with using helm from inside the microk8s snap, or if the user already has helm installed on their host, interoperating with the config/data that the version of helm on the host manages.
I asked, and helm does not make any backwards or forwards compatibility guarantees about this data, but it has not changed in a long time and is relatively stable. Helm also very specifically integrates with kubernetes in a way that makes sense to be able to share this config/data with the microk8s snap (when the microk8s snap is strictly confined).
cc @joeborg as a maintainer of the microk8s snap.