The problem is that 99% of users don't know about them or don't know how to disable them. The damage was already done when years ago apps started to require permissions for hardware or data they shouldn't have access to, so that users now blindly accept every request because "the app comes from the official store, so it is safe".