Or the accessibility permission, or to some degree the access all files ones; but it's also enough for the app to pilfer the data you trust it with.

The Play Store's scanning is very far from perfect, and the amount of crap that's on it, combined with the trust that people have towards it, and apps' unfettered access to internet, makes malicious software easily more common than on PCs.

Even without considering as malicious the enormous data collection that almost everything on the Play Store does, encouraged by Google