I don't think it's that people are stupid. Blindly trusting these apps to not take advantage or mishandle their access to personal data is also naive.

It's possible to do business without scanning your customer's faces, tracing their contacts, selling details of their transactions to aggregators, etc ... where does the line get drawn?

And that doesn't even address data that is "accidentally" collected.