There's a point to be made about expectations, though. On a desktop by default you know that apps can do whatever they want, but on an OS with a built-in sandbox and permissions like "internet", you expect it to not be able to access the internet. That may lead to changes in your behavior, like installing any random app with no permissions instead of carefully evaluating them beforehand.