Issue 1:
I've been testing 1.7.0 while packaging it for nixpkgs and I usually test it with the cat example but it's now requiring --allow-read but it also doesn't accept the flag either during compile or using the compiled result.

(cat src: https://deno.land/std@0.84.0/examples/cat.ts)

Since nixOS is pretty different I've also replicated the issue using a buster-slim container

cat /etc/os-release
PRETTY_NAME="Debian GNU/Linux 10 (buster)"
NAME="Debian GNU/Linux"
VERSION_ID="10"
VERSION="10 (buster)"
VERSION_CODENAME=buster
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"

$ wget https://github.com/denoland/deno/releases/download/v1.7.0/deno-x86_64-unknown-linux-gnu.zip
# ...
2021-01-20 10:46:13 (1.89 MB/s) - 'deno-x86_64-unknown-linux-gnu.zip' saved [21261828/21261828]

$ unzip deno-x86_64-unknown-linux-gnu.zip
Archive: deno-x86_64-unknown-linux-gnu.zip
inflating: deno
$ ./deno --version
deno 1.7.0 (release, x86_64-unknown-linux-gnu)
v8 8.9.255.3
typescript 4.1.3

$ ./deno compile --unstable https://deno.land/std@0.84.0/examples/cat.ts
Download https://deno.land/std@0.84.0/examples/cat.ts
Check https://deno.land/std@0.84.0/examples/cat.ts
Bundle https://deno.land/std@0.84.0/examples/cat.ts
Compile https://deno.land/std@0.84.0/examples/cat.ts
Emit cat
$ ./cat file
error: PermissionDenied: read access to "file", run again with the --allow-read flag
at processResponse (deno:core/core.js:212:11)
at Object.jsonOpAsync (deno:core/core.js:229:12)
at async Object.open (deno:runtime/js/30_files.js:44:17)
at async file://$deno$/bundle.js:3:18
$ ./cat --allow-read file
error: PermissionDenied: read access to "--allow-read", run again with the --allow-read flag
at processResponse (deno:core/core.js:212:11)
at Object.jsonOpAsync (deno:core/core.js:229:12)
at async Object.open (deno:runtime/js/30_files.js:44:17)
at async file://$deno$/bundle.js:3:18
$ rm cat

$ ./deno compile --unstable https://deno.land/std@0.84.0/examples/cat.ts --allow-read
Check https://deno.land/std@0.84.0/examples/cat.ts
Bundle https://deno.land/std@0.84.0/examples/cat.ts
Compile https://deno.land/std@0.84.0/examples/cat.ts
Emit cat
$ ./cat file
error: PermissionDenied: read access to "--allow-read", run again with the --allow-read flag
at processResponse (deno:core/core.js:212:11)
at Object.jsonOpAsync (deno:core/core.js:229:12)
at async Object.open (deno:runtime/js/30_files.js:44:17)
at async file://$deno$/bundle.js:3:18

Issue 2:
~/p/g/d/deno ❯❯❯ deno compile --unstable https://deno.land/std@0.79.0/examples/cat.ts CODE_OF_CONDUCT.md
Check https://deno.land/std@0.79.0/examples/cat.ts
Bundle https://deno.land/std@0.79.0/examples/cat.ts
Compile https://deno.land/std@0.79.0/examples/cat.ts
Emit cat
~/p/g/d/deno ❯❯❯ ./cat
error: PermissionDenied: read access to "CODE_OF_CONDUCT.md", run again with the --allow-read flag
at processResponse (deno:core/core.js:223:11)
at Object.jsonOpAsync (deno:core/core.js:240:12)
at async Object.open (deno:runtime/js/30_files.js:44:17)
at async file://$deno$/bundle.js:3:18

run again with the --allow-read flag makes no sense in self-contained binaries because after (#8738) permissions are embedded in the binary and can't be changed.

In this situation we should provide different message.

CC @lucacasonato @nayeemrmn