Another worst thing about android is giving carte blanche to apps for accessing messages. Most of apps these days use OTP to validate phone number. To read OTP message automatically, they ask permission to access text-messages. I knew few of such apps who keep polling user's text-messages to server daily without user's knowledge.