[t0astbread]

> Instead it should disable everything by default, let the user turn particular permissions on explicitly

That would be great for power users but it wouldn't work for "the average dumb user" since they would just enable every permission when asked to do so if they don't know what it means and how it could be abused. And power users already have that in Android forks designed for them. (I can't speak for iOS.)

> All the reasonable TOS terms are obvious and can be implied

That's your definition of reasonable. With a rule like this a platform would kill off both freedom- and privacy-minded software as well as spyware (the general trackery), thus pissing off almost everyone who cares about those kinda things.