Does not always work because shady apps often check for permissions on boot and refuse to start if i.e. some fart app can't access that contact list of yours "it desperately needs to function properly". Denying permissions only mitigates cases when all permissions are asked due to the lack of proficiency or laziness of app developers not an intended malicious behavior.