I used to believe that and installed CM 12.1 on my phone only to find out that the restrictions don't really work. Whatsapp was able to read my messages (automatic phone verify) when I had disabled the access. Digging around I found out this is the case even with XPrivacy (there are open issues on github) which is supposed to be more extensive. There are some situations when the blocks aren't enforced at all (like some native calls). I got a nexus 5x, android 6 permissions feature actually works.

I use this extensively myself, but the one problem that I'm facing is that it makes some applications unstable. Usually, I just uninstall them as I'd rather sacrifice my comfort than my security and privacy.

Thanks for this, I didn't realise you could do this in CM. You can also check when the permissions were being used. For the Netflix app I noticed the "record audio" permission had never been used, but I've set it to explicitly ask me if it tries to use it.

Android 6.0 does those things for you too. (Doze and App Standby)

sounds like cm is used as a testing channel for new features.