So you're saying that if we just allow them to request full permissions upfront then there's no need to go around the backdoor?

... not sure how that's supposed to be reassuring for user privacy concerns.

Again, on Android, you've got even things like flashlight apps asking for far too many permissions, let alone Facebook.