It was a haunted house. It was a creepy portrait. The player CHOSE to make the portrait magical -- I did not. There was no magical gotach trap here, because there was no gotcha at all -- the player chose to make it magical in the context of a creepy haunter manor home (that belongs to Lord Scurlock, a being that has been alive for perhaps as long as the Emperor, ie at least a thousand years, and is known to be up to serious occult stuff). The player then CHOSE to interact with the portrait they wanted to be magic in a way that directly puts occult consequences on the table -- ie, Attune. So, yeah, to get to the part where I narrated that the portrait was doing a bad thing, we have two player choices, a lot of foreshadowing about occult things, and then a failed check which all led up to, not the portrait sucking out his soul, but that this was now on the table.
As for the GM fiat statement -- if the GM can only decide to let player actions stand or negotiate a roll, this is very different from a GM that can say yes, roll, or no. The authority to deny a thing is the control over the thing. All are, yes, exercises of GM authority, but that's not a particularly interesting observation. There's a huge difference in player authorities and agencies between the two models. Let's not pretend they're the same.