> Maybe the OS just tracks and logs all of your apps' activity

The problem here, is that like so many social-media apps, the first thing the app will do is scrape as much as it possibly can from the device, lest it lose access later, at which point auditing it and restricting its permissions is already too late.

Give an inch, and they’ll take a mile. Better to make them justify every millimetre instead.