I'm primarily an Android developer myself and I do respect my users <s>and that's why I have no job</s>, so yes, I request permissions only when they're absolutely necessary and when it's obvious as to why the permission is needed.

The bigger problem, though, is that you can't trust bad actors to act good. DNT in browsers has showed that extremely clearly: it was meant as a marker for you to not be tracked, yet advertisers used it as an additional bit for fingerprinting. Policy might be a way, but it relies on humans looking at apps. It's always much more effective to have technical measures in place, if possible. As in, no mater how much you'd like, you can't track a user across the web if their browser doesn't accept third-party cookies. And many app developers are in no way better than web developers with their incentives, intentions and tactics, it's just that the web makes these issues more noticeable.