I don't know if this is still the case, but at one point the permission needed to access the flashlight also gave access to the camera. And there aren't restrictions on network connections from apps. (I'd love to have app network access restricted by permissions, but that would be a large change.)

And in any case, Android has had built-in flashlight support for a while now, for any phone that has a camera with a flash. Is the "turn the screen bright white" style still useful with modern Android?