To your last point, yes. The average user doesn’t even glance at the permissions before blindly accepting them. It is also true that an alarmingly high number of users/consumers /don’t care/ about basic privacy concerns that affect things like targeted ads, PII, and information that could be used to affect things like credit score.