" to harvest the phone owners private data directly"

And Google is the king of that.

While you make a good point - it's not like Google can take the high road on this.

How much of a problem is this on iOS?

Most apps will work fine if you decline their extra permission requests, though obviously certain features may not work without them. The rest of your app has to function normally, and you definitely can't crash or otherwise programmatically quit.

There are one or two apps I use that do require extra permissions to function – like the NFL Sunday Ticket app won't work unless I enable location services, because it needs to black-out local games due to broadcast rights.

Some things are simply not available on iOS. For example, your app can't get a list of other apps you have installed, or send/receive text messages.

Of course, every once in a while someone finds a way to abuse a different API maliciously. Apple had to limit the availability of the API used to determine if a URL scheme can be handled by the device because Twitter was spamming it to determine what apps you had installed (if your device can open a 'dominospizza://' link, they knew you had the Dominos app installed). So now you have to whitelist up to 50 URL schemes your app might try to launch.

On Android 5.x and earlier, you had to grant all possible requested permissions up-front during installation.

Check out verify.ly to get some surprising info on what iOS apps are doing behind the scenes. There are plenty of apps that have the ability read your full contact data or your calendar without ever asking you. Skitch, Amazon, and Skype do one or more of those. I have deleted them and gone back to the web app for Amazon. FaceTime replaced Skype, and I'm stuck with Markup in Photos as a poor replacement for Skitch.

Of course there are plenty of safe apps that do not abuse APIs - for example, the Deliveries app by JuneCloud.

Perhaps I should clarify that the "they" I referred to are the app publishers, not necessarily Google.