That was long a differentiating factor between iOS and Android: Android's permissions were granted at install, iOS asked for each one individually, allowing much greater control.
But, I thought that was changing. Is Android not moving to the more granular model?
Yes, Android apps which want shiny modern features have to prompt on usage, but if an app says it is for old Android that couldn't do this it doesn't have to implement that behaviour (of course then it can't have new features since those didn't exist).
Google set a deadline for when no new "old" apps are allowed but I didn't pay attention to when that is.
I routinely tell (Android) apps that try to do too much that no they can't have access, but mostly I just uninstall them and use something better.
I installed WA on a new phone last week and it asked for the "Access Contacts" permission.
I denied and the app worked just fine, without showing my contacts.
In general, the trend to optional permissions asked on first use is introduced in more and more apps and it's refreshing.