Once you've granted the permission, any future version of even an app you've verified can expand its use of that permission into data I'm not willing to share. I know it's not your fault but you still end up being the victim (of my effort not to be a victim).
Google in it's insanity has required an "all or nothing" approach to permissions. Because of this, the vast majority of all users must accept all permission requests up front, and developers are highly motivated to ask for more than they need up front to prevent asking for more later.
The far, far superior model for permissions is for basic permissions to be granted at install, and each new permission to be requested at run time.
But, how can the majority* of your apps download personal information, hijack your contact list, and spy on your location if you have to explicitly give them the permission to do so when they begin the function...
* I'm being hyperbolic, but we have very few ways of actually knowing how many apps abuse their permissions. Generally, one or two popular ones get "called out" for doing what everyone is doing, and everyone descends back into feigned ignorance at permission abuse.
READ_GSERVICES is the permission in question and is required for Google Maps. I'd like to switch to an open mapping tool but it's not a top priority right now.
As for the sleeping mechanism: you're correct, an in fact we do only wake the phone up every x minutes. It's off ~99% percent of the time. We require the wakelock to ensure that the phone stays on long enough for us to measure the barometer and store/transmit the data. We don't keep the device on for any longer than absolutely required.