Would people reasonably expect that the contents of their SD card and a list of all their purchases could be silently uploaded by an app they'd given no permissions to?

If not, this is clearly not delivering control to the user.