Assuming it's a built-in iOS/Android feature, hopefully app review would catch apps trying to circumvent the fake permissions, and the risk of blocking real users would probably discourage them (I almost never use SMS unless it's for a verification code, and I have no reason to keep those messages).