The major huge difference is that because most apps request minimal permissions, the one that requests a lot (or an odd one) stands out against the background of the rest.

Whereas g-store apps, because they almost always request too many to begin with, train users that 17 different permissions for a 'flashlight' app is normal (made up example), and the malware does not stand out as 'odd' in that environment.