The permission model in Android changed in Android 6.
Apps using the sdk that was released with Android 6 will have to ask users for permissions as well.
I expect that eventually older SDK's will stop working on modern Android.
iOS does offer a slightly nicer three tiered request strategy over Google's yes|no. iOS let's you grant location access only when the app is active
[1]: https://developer.android.com/about/dashboards/index.html
That's because they count all the pings of devices that answered across the globe in a sliding window and that is a hugely different number than actual maket share across US and EU and comparable markets. Sure we can then go into details about how poor Indians / Chinese / Africans need secure phones too (and I agree!), but those people have no means to afford an iPhone either.
(And no, sorry, I can't provide you with NDA protected market data :/ )
The pretty large plurality (if not majority) of Android devices in the wild don't have have Google's services installed and many of those also get no software updates -- so they're stuck on what old ROM they came with, probably Lollipop.