I asked the same question a few years ago, and the answer I arrived at is that the app has, by default, more permissions (not only technical but also conventional) to collect data, send push notifications, and otherwise harass the user.
iOS apps have to request permission from user to send push and for basically every other problematic permission.
iOS apps have to request permission from user to send push and for basically every other problematic permission.