Rather they should only do what you let them. It's nonsensical that mobile OSes don't let you fake certain permissions being enabled (for example having a location spoofing option).