This is only because the trust given to apps is insane. No distinction between foreground GPS and background GPS? Sure, I wouldn't want web sites to work that way either. But if permissions were sane there would be no reason not to have native apps and web apps ask for the same permissions in the same way.

I don't ever want to give a website access to microphone because someone could turn it on via an XSS. Websites on the whole seem to be far more vulnerable than mobile apps because:

1. their code is refreshed on every load,

2. their software is often updated on a daily if not hourly basis,

3. they will often pull code from remote sources on every page load,

4. they don't even have to pass the minimal review and code signing of an app store,

5. and it is very likely that they are written in javascript.

I agree with your general point that better permissions would improve the situation. For instance asking each time it wants to use the microphone, rather than an approve once model.

There has been a distinction between the two on iOS for at least two years.