Think about it. When your app impersonates a domain user account, that
domain user account must have permission to access the directory. Therefore,
any domain user account that has permission to access that directory can be
used to access the directory.

Now, see if you can follow me here: If any domain user account must have
permission to access the directory, and your application must impersonate a
domain user account with permission to access the directory, your
application's user account could access that directory without impersonating
another domain user account if it had permission to access the directory
itself.