The problem is not that permissions are pretty good. The problem is that you have to give many apps way too many permissions to work.

Let's make an example; I use the FitBit tracker and quite like it. I also use its own Android app. A few months ago, they decided that in order to sync you need to enable GPS. Now, there is no reason on Earth why I need to turn on GPS to download data from my watch and upload it to FitBit's server. Still, no permission or GPS disabled = no sync.

Frankly, I do not think this is in my best interest. And I wonder how many of their user-base noticed the change of permissions.