Good to know, but that’s only marginally better, as a malicious app developer only needs to come up with a legitimate reason for the entitlement.