They absolutely do. Every permission you request has to have a valid justification and the user can only be asked when the permission is actually needed. The API allows you to specify every single permission and require them at app launch, it's the human reviewer who makes sure they're being used appropriately.

I say this as someone who has had apps denied by reviews for requesting a permission that was not needed inside of the version of the app I submitted to the store. They absolutely do review and vet apps for privacy and security.

APIs that depend on policy to prevent abuse will now just not be available at all.

As it should be. Apple doesn’t have the ability to verify what you do with the data that gets to your app, so they should not pretend to be able to certify it.

What? Apple, today, has enforced the ability to ensure that a flashlight app isn't vacuuming up your location data.