>> the way android apps just demand permisions for everything making the security benefit of permissions largely pointless.

> That hasn't been the case for a pretty long time. Now the permissions are quite granular and you can accept and refuse specific one at any time.

This is technically a correct answer, but I've seen the bad habit of asking for many permissions (and sometimes refusing to work without) being more common on Android. An example is a bank's app that will refuse to launch (or I mean, provide any meaningful information/experience) unless location permission is given (this is when giving the permission means an "always allow") and unless it's connected to a cellular data network (not WiFi). On iOS, the app is better behaved and will work with some useful functionality when certain permissions are denied.

This could be due to an overly aggressive anti-fraud library/service like ThreatMetrix (I don't know if they do these things, they're just the only example I know).

If they refuse to run without permissions that make sense to me then they get tossed. You don't need my location for me to play a solo platformer.

Though it's bizarre to me what permissions require a pop-up and which don't. You think all you've granted is, say, looking at files, then you check the actual granular list and there's a dozen different ones including internet access.

Making full network access a mandatory always-on permission was a huge security mistake IMO. Every app can port scan your network, and probably some do as part of fingerprinting (some websites do at least, and I assume apps are more brazen).

It's not mandatory, it's just incredibly common. There's also an untoggleable permission to allow viewing network access by other apps.