Does that really matter for a local-only 5KB app that only talks with my phone‘s flashlight, or reads sensor data? Now, maybe for the 500MB adware-filled “flashlight” app that connects to 100s of servers and demands access to everything my device can do, but that would be banned on any competent app store anyway.

No but enforcing policy is manageable. Enforcing reasonable security measures based on nuances and case by case situations is not manageable for an ecosystem of that scale.

I don't know if this is still the case, but at one point the permission needed to access the flashlight also gave access to the camera. And there aren't restrictions on network connections from apps. (I'd love to have app network access restricted by permissions, but that would be a large change.)

And in any case, Android has had built-in flashlight support for a while now, for any phone that has a camera with a flash. Is the "turn the screen bright white" style still useful with modern Android?

Kind of a side note, but flashdim is an amazing open-source flashlight app that everybody needs[1][2][3].

[1]: https://github.com/cyb3rko/flashdim

[2]: https://f-droid.org/en/packages/com.cyb3rko.flashdim/

[3]: https://play.google.com/store/apps/details?id=com.cyb3rko.fl...

It is if your flashlight's broke.

GrapheneOS (https://grapheneos.org/) contains network access permission.