It’s about what apps can do with just default permissions, no? Not about what’s theoretically possible given full access to the phone.