IMHO, modules should do I/O when needed. In your current case, returning a hash ref with file content is doable due to the small size of the expected file contents. However, there are situations when modules have to process files as big as several GB, the module simply cannot return the file content (unless module returns it bit by bit, just adding a bit more hassle to calling program).

I also feel that the worry in OP is somewhat contradictory: if one assumes that the caller knows how and whether and where they need to open file and write file contents in a hashref out with correct permissions, then how can one not assume that they could know to send in correct filename/path with the right permissions for your module to write (after all, they do it in their calling program, right)?

In all, I see very little justification for providing hashref with file contents just so that users can deal with I/O themselves (unless there are special reasons unnamed in your question).