I used to believe that and installed CM 12.1 on my phone only to find out that the restrictions don't really work. Whatsapp was able to read my messages (automatic phone verify) when I had disabled the access. Digging around I found out this is the case even with XPrivacy (there are open issues on github) which is supposed to be more extensive. There are some situations when the blocks aren't enforced at all (like some native calls). I got a nexus 5x, android 6 permissions feature actually works.