Also if it has 100s of dialogs popping up users get a fatigue. They tend to say yes to everything and that's how default Android permissions are
Security model should be automated. Request only when needed
Can't see why it needs all permissions upfront. Apps keep nagging u until we provide all permissions.
90% of my reddit usage is posting amd reading text. 10% is photo related. So browser is better for me.
I don't need an app to have all access when I upload photos once a month
Microphone is granted along camera. Camera is needed if you want to upload photos.(I might be wrong about the microphone)
Storage is always necessary for apps that cache anything from the web.
That leaves contacts and location.
So you can disable contacts and location, but all your metadata including device and network information is read and probably transmitted. In most cases it's good enough as location information as well.