Those "cracked" versions often require extra permissions.

My favorite was a local "discover which on your contacts is on the leaked Covid quarantine list[1]" scam app. It claimed that the extra permission dialogs are just fearmongering by Google, who is in cahoots with big pharma, and wants covid to spread to sell more medications.

[1] In fact, no such leak has ever taken place, its existence was just part of the setup for the scam.