I am curious about this as well, especially since when working on a facebook photo app we did A/B testing of the difference between asking for just the basic permission and asking for a page of permissions (publishing, photos, offline, email etc) and we saw no difference and no drop off. this was a delayed permissions grant as in people can browse the app without granting any permissions and permissions were only requested when they needed to goto the next step so to speak.

I, too, am curious how they've come to that conclusion. I would think it makes a difference what the app is asking of you. Asking for a "like" is certainly much less invasive than asking for access to your friends, photos, personal info, refrigerator, etc... In a split second, the longer/deeper that list is, I'd think the less likely someone would be to click "OK".

After working many years in information security, I agree with you 100%. Users are looking to get their work done and will click whatever it takes to get there.