Yes, and that's why apps on Android need to explicitly ask for permission first. Giving the app that permission is a declaration of trust by the user. Not letting people do that would be a disaster for user agency in my opinion.

GDPR and similar laws also mandate clear user consent.