They aren't capable of handling the case where they aren't given access to a permission though, so that makes them potentially more prone to crashing.
My idea is that if they try to access your contacts, instead of receiving a potentially unhandled "access denied" exception, they should just receive an empty contact list. Et cetera.