This morning I spoke to someone who had installed it; it had SMSd everyone in her contacts, and she was understandably not too happy. It's not just an assumption that they're misusing permissions.

You are asking the author to assume that apps that ask for broad permissions are trustworthy. There have been far too many counterexamples for that position to be tenable.